Arbitrary file deletion

In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column...

Arbitrary file deletion

An issue was discovered in taoCMS v3.0.2. There is an arbitrary file read vulnerability that can read any files via admin.php?action=file&ctrl=download&path=../../1.txt...

CVE-2022-23609: Improper Limitation of a Pathname to a Restricted Directory

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize user input used to remove files leading to file deletion only limited by the process permissions. Users are advised to upgrade as soon as possible...

iTunesRPC-Remastered 路径遍历漏洞

iTunesRPC-Remastered is a rich discordant state application used with iTunes and Apple Music. iTunesRPC-Remastered suffers from a path traversal vulnerability that stems from iTunesRPC-Remastered not properly sanitizing user input for file deletion. An attacker could exploit this vulnerability to...

PT-2022-16123

Name of the Vulnerable Software and Affected Versions iTunesRPC-Remastered affected versions not specified Description The issue concerns a failure to properly sanitize user input, which can lead to file deletion limited only by the process permissions. Recommendations At the moment, there is no...

Pillow 输入验证错误漏洞

Pillow is a Python based image processing library. An input validation error vulnerability exists in versions of Pillow prior to 9.0.1, which stems from the product's remove operation not validating user input data, and can be exploited by an attacker to delete files...

CVE-2021-42753

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in...

CVE-2021-42753

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in...

Path traversal

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in...

CVE-2021-42753

CVE-2021-42753 describes a path traversal vulnerability in the FortiWeb management interface that may allow an authenticated attacker to perform arbitrary file and directory deletions in the device filesystem. Affected product scope includes FortiWeb versions 6.4.1 and below, 6.3.15 and below, an...

CVE-2021-42753

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in...

CVE-2021-42753: Improper Limitation of a Pathname to a Restricted Directory

An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiWeb management interface 6.4.1 and below, 6.3.15 and below, 6.2.x, 6.1.x, 6.0.x, 5.9.x and 5.8.x may allow an authenticated attacker to perform an arbitrary file and directory deletion in...

Fortinet FortiWeb 路径遍历漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content. A path traversal vulnerability exists that...

Vulnerabilities fixed in Fortinet FortiWeb

Vulnerabilities have been fixed in Fortinet FortiWeb. The vulnerabilities marked CVE-2021-36193, CVE-2021-41018 and CVE-2021-43073 allow an authenticated remote malicious person able to execute arbitrary code or commands. The vulnerability with attribute CVE-2021-42753 enables an authenticated...

CVE-2022-24218

CVE-2022-24218 affects eliteCMS v1.0. The issue resides in /admin/delete_image.php and allows attackers to delete arbitrary files. From the provided metrics, CVSSv2 base score is 6.4 (Network, Low attack complexity, None auth, I/P) with Partial integrity/Partial availability impact, and CVSSv3.1 ...

Path traversal

The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server...

CVE-2021-24761

The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server...

CVE-2021-24761

The CVE concerns the WordPress plugin Error Log Viewer (versions prior to 1.1.2). The underlying issue is lack of nonce verification when deleting a log file and absence of path traversal prevention, enabling a logged-in administrator to delete arbitrary text files on the web server. Affected com...

CVE-2021-24761 Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF

The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server...

PT-2022-9457 · WordPress · Error Log Viewer

Name of the Vulnerable Software and Affected Versions: Error Log Viewer WordPress plugin versions prior to 1.1.2 Description: The issue concerns a lack of nonce check when deleting a log file and the absence of path traversal prevention. This could allow attackers to make a logged-in admin delete...