UReport 路径遍历漏洞

UReport is a high-performance pure Java reporting engine based on the Spring architecture that prepares complex Chinese reports and statements by iterating over cells. A security vulnerability exists in UReport version v2.2.9, which stems from an arbitrary file deletion vulnerability...

Trend Micro Apex One Multiple Vulnerabilities (000291830)

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 Server Build 11136 and Agent Build 11136. It is, therefore, affected by multiple vulnerabilities: - An arbitrary file deletion vulnerability in the Damage Cleanup Engine...

Arbitrary File Deletion

github.com/pterodactyl/wingso is vulnerable to Arbitrary File Deletion. A remote authenticated attacker is able to delete files and directories recursively on the host system via the vulnerable Delete function of filesystem.go. This vulnerability can further be exploited to overwrite existing fil...

CVE-2023-23698

Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component. A local malicious user may potentially exploit this vulnerability leading to arbitrary file delete...

CVE-2023-25168

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this exploit, an attacker must have an...

Orangescrum Path Traversal Vulnerability

Orangescrum is a project and task management software tool that also provides productivity tools for work organization and team collaboration. Orangescrum suffers from a path traversal vulnerability that stems from the application using an uncleaned attacker-controllable parameter to construct...

CVE-2023-25168

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with "GHSA-p8r3-83r8-jwj5" to overwrite files on the host system. In order to use this exploit, an attacker must have an...

CVE-2023-25168 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this exploit, an attacker must have an...

CVE-2023-25168

CVE-2023-25168 affects Pterodactyl Wings (server control plane). Description: UNIX Symbolic Link (Symlink) Following enables deletion of files/directories on the host when a server is allocated; may be used with GHSA-p8r3-83r8-jwj5 to overwrite host files. Root cause: symbolic link handling in Wi...

CVE-2023-25168 Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this exploit, an attacker must have an...

Arbitrary file deletion

A file disclosure vulnerability in the Palo Alto Networks Cortex XSOAR server software enables an authenticated user with access to the web interface to read local files from the server...

CVE-2023-25168: Improper Link Resolution Before File Access

Wings is Pterodactyl's server control plane. This vulnerability can be used to delete files and directories recursively on the host system. This vulnerability can be combined with GHSA-p8r3-83r8-jwj5 to overwrite files on the host system. In order to use this exploit, an attacker must have an...

PT-2023-19953 · Pterodactyl · Wings

Name of the Vulnerable Software and Affected Versions: Wings versions prior to v1.11.4 Wings versions prior to v1.7.4 Description: This issue affects Wings, Pterodactyl's server control plane, allowing an attacker to delete files and directories recursively on the host system. The vulnerability c...

PT-2023-6742 · WordPress · Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: The Quiz And Survey Master for WordPress versions up to, and including, 8.0.8 Description: The issue is related to a missing capability check on the function associated with the qsm remove file fd question AJAX action. This allows...

URI validation failure on SVG parsing. Bypass of CVE-2023-23924

Summary Due to the difference in the attribute parser of Dompdf and php-svg-lib, an attacker can still call arbitrary URLs with arbitrary protocols. Details Dompdf parses the href attribute of image tags with the following code: src/Image/Cache.php line 135-150 php function $parser, $name,...

VMware Workstation 17.0.x < 17.0.1 Vulnerability (VMSA-2023-0003)

The version of VMware Workstation installed on the remote Windows host is 17.0.x prior to 17.0.1. It is, therefore, affected by a vulnerability. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

PT-2023-6750

Name of the Vulnerable Software and Affected Versions Dell Command | Integration Suite for System Center versions prior to 6.4.0 Description The issue is related to an arbitrary folder delete vulnerability during uninstallation. A locally authenticated malicious user may potentially exploit this...

PT-2023-6777

Name of the Vulnerable Software and Affected Versions Dell Command | Update versions prior to 4.6.0 Dell Update versions prior to 4.6.0 Alienware Update versions prior to 4.7.1 Description The issue is related to an insecure operation on Windows Junction in the installer component, which could be...

The vulnerability of VMware Workstation’s hypervisor is related to access control errors, which allow a malicious user to delete arbitrary files from the root operating system.

The vulnerability of VMware Workstation hypervisor is related to access control errors. Exploiting this vulnerability could allow an attacker to delete arbitrary files from the root operating system...

CVE-2023-20854

VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed...