13392 matches found
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.6.6 - File Upload and File deletion via CSRF
The plugin is lacking CSRF and validation when uploading or deleting files, which could allow attackers to make a logged-in admin upload or delete files via a CSRF attack...
The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload or delete certain files.
The vulnerability of the Cisco Identity Services Engine’s web management interface relates to the implementation of security functions at the client side. Exploiting this vulnerability allows a malicious actor to upload or delete certain files using a specially created HTTP request...
CVE-2023-33294
An issue was discovered in KaiOS 3.0 before 3.1. The /system/bin/tctwebserver binary exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and executes them as root. Because it is not permission or context restricted and returns...
PT-2023-24275 · Kaios · Kaios
Name of the Vulnerable Software and Affected Versions: KaiOS versions 3.0 through 3.0 Description: An issue was discovered in the /system/bin/tctweb server binary, which exposes a local web server that responds to GET and POST requests on port 2929. The server accepts arbitrary Bash commands and...
Cisco Identity Services Engine Arbitrary File Deletion Vulnerability
Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An arbitrary file deletion vulnerability exists...
Design/Logic Flaw
Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...
CVE-2023-20171 Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities
Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...
CVE-2023-20172
Cisco Identity Services Engine (ISE) is affected by CVE-2023-20172, describing multiple vulnerabilities in ISE that could allow an authenticated attacker to delete or read arbitrary files on the underlying OS. The issues appear to be tied to the web interface and require valid credentials on an a...
Cisco Identity Services Engine 输入验证错误漏洞
Cisco Identity Services Engine ISE is an environment-aware platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. An arbitrary file deletion vulnerability exists...
CVE-2023-20106: Client-Side Enforcement of Server-Side Security
Multiple vulnerabilities in Cisco Identity Services Engine ISE could allow an authenticated attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker must have valid credentials on an affected device. For more information about...
CVE-2023-20171
Cisco Identity Services Engine (ISE) is affected by CVE-2023-20171: authenticated, credentialed attackers can delete or read arbitrary files on the OS. Affected versions include Cisco ISE 3.1.x before 3.1P6 and 3.2.x before 3.2P2. Cisco and third-party advisories (e.g., Cisco security advisory ci...
Delta Electronics InfraSuite Device Master CtrlLayerNWCmd_ReportFileOperation Directory Traversal Denial-of-Service Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on affected installations of Delta Electronics InfraSuite Device Master. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within t...
PT-2023-2828 · Cisco · Cisco Identity Services Engine
Name of the Vulnerable Software and Affected Versions: Cisco Identity Services Engine ISE affected versions not specified Description: The issue is related to multiple vulnerabilities in the Cisco Identity Services Engine ISE that could allow an authenticated attacker to delete or read arbitrary...
Arbitrary file deletion
An arbitrary file write vulnerability in Jenkins Pipeline Utility Steps Plugin 2.15.2 and earlier allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content...
PTC Vuforia Studio 授权问题漏洞
PTC Vuforia Studio is an easy-to-use, web-native tool from PTC for authoring domain and task-specific experiences. These experiences provide integrated views of digital and physical product data, dashboards, and alerts through 2D, 3D, and augmented reality. An authorization issue vulnerability...
WordPress Bookly Plugin <= 21.7.1 is vulnerable to Arbitrary File Deletion
Software Bookly Type Plugin Vulnerable versions = 21.7.1 Fixed in 21.8 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-26526 Patch priority Medium CVSS severity Medium 7.7 Developer Claim ownership PSID a06cfd6ac407 Credits Rafie Muhammad Patchstack...
Arbitrary file deletion
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
CVE-2023-20098
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could...
CVE-2023-20098: Path Traversal: '../filedir'
A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could...