PT-2023-13934 · WordPress · Images Optimize/Upload Cf7

Name of the Vulnerable Software and Affected Versions: Images Optimize and Upload CF7 WordPress plugin versions 2.1.4 and earlier Description: The issue concerns a lack of validation for files to be deleted via an AJAX action, which is accessible to unauthenticated users. This could allow attacke...

CVE-2022-4101: Undefined Security Weakness

The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack...

WordPress plugin Images Optimize and Upload CF7 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal vulnerability exists ...

PT-2023-8426 · Nextcloud +1 · Nextcloud Server +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Server versions 24.0.0 through 24.0.8 Description: The issue is related to incorrect permission assignment for files, allowing a user to escalate their permissions and delete files they were not supposed to delete, but only view or...

The vulnerability of the command-line interface of FortiWeb web applications relates to incorrect path name restrictions for access-controlled directories. This allows attackers to delete any files from the file system on the vulnerable device.

The vulnerability of the command-line interface of FortiWeb web applications is related to incorrect path name restrictions for access to restricted directories. Exploiting this vulnerability could allow a malicious actor to delete any files from the file system of the vulnerable device remotely...

Arbitrary file deletion

SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will overwrite files on the filesystem when opening a malicious ZIP containing a symlink as the first item...

Improper Access Control

github.com/usememos/memos is vulnerable to improper access control. Insecure direct object references of the library allows an attacker to retrieve or delete files uploaded by other users...

Multiple vulnerabilities in Trend Micro Apex One and Apex One as a Service

Overview Trend Micro Incorporated has released security updates for Apex One and Apex One as a Service. Trend Micro Incorporated reported these vulnerabilities to JPCERT/CC to notify users of the solutions through JVN. Impact Privilege escalation and file deletion in Damage Cleanup Engine compone...

File Deletion Detected

Description Vulnerability allows deleting files in the server, affect the logic of the source code or disrupt the program to make the original way of operation Proof of Concept B1. Login and access to admin.php?p=uploader&action=mediamanager B2. Delete 1 uploaded file B3. Change parameter...

Spoofing

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. Please note: an attacker must first obtain...

Trend Micro Apex One和Trend Micro Apex One as a Service 后置链接漏洞

Trend Micro Apex One and Trend Micro Apex One as a Service are both products of Trend Micro, Inc.Trend Micro Apex One is endpoint protection software.Trend Micro Apex One as a Service is an Trend Micro Apex One as a Service is an enhanced endpoint security solution. A backlink vulnerability exist...

Arbitrary file deletion

nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary...

The vulnerability of the Damage Cleanup Engine component in Trend Micro Apex One and Apex One as a Service anti-virus software allows a malicious actor to elevate their privileges and delete arbitrary files.

The vulnerability of the Damage Cleanup Engine component in Trend Micro Apex One and Apex One as a Service anti-virus software exists due to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability can allow attackers to enhance their privileges and...

CVE-2022-45798

A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges by creating a symbolic link and abusing the service to delete a file. Please note: an attacker must first obtain...

CVE-2022-47926

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fstdel.inc.php...

CVE-2022-47926

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fstdel.inc.php...

Arbitrary file deletion

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fstdel.inc.php...

CVE-2022-47926

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php. Affected component: AyaCMS (PHP web app). Root cause: endpoint allows deletion of files; impact is high (potential loss/overwrite of files). Exploitation status is not detailed in the provided documents. Remediatio...

AyaCMS 参数注入漏洞

AyaCMS is an extremely simple and free open source PHP website builder. A security vulnerability exists in AyaCMS version 3.1.2, which can be exploited by easily deleting files via /aya/module/admin/fstdel.inc.php...

PT-2022-28089 · Ayacms · Ayacms

Name of the Vulnerable Software and Affected Versions: AyaCMS version 3.1.2 Description: The issue allows for file deletion via the /aya/module/admin/fst del.inc.php endpoint. Recommendations: For AyaCMS version 3.1.2, as a temporary workaround, consider restricting access to the...