PT-2021-5107

Name of the Vulnerable Software and Affected Versions Kaspersky VPN Secure Connection affected versions not specified Kaspersky Internet Security affected versions not specified Kaspersky Total Security affected versions not specified Kaspersky Security Cloud affected versions not specified...

Hancom With AnySign4Pc 路径遍历漏洞

Hancom With AnySign4Pc is an executable .exe file from the South Korean company Hancom With. A path traversal vulnerability exists in Hancom With AnySign4Pc. The vulnerability stems from exploiting the parameters of the getPFXFolderList function, which allows an attacker to see authorization...

PT-2021-12702

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue allows attackers to view authorization certification information and delete files by exploiting the getPFXFolderList function. This is possibl...

CVE-2020-7882: Path Traversal: '../filedir'

Using the parameter of getPFXFolderList function, attackers can see the information of authorization certification and delete the files. It occurs because the parameter contains path traversal charactersie. '../../../'...

Lantronix PremierWave 2050 Path Traversal Vulnerability

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. The Lantronix PremierWave 2050 in version 8.9.0.0R4 contains a security vulnerability that stems from the Web Manager FsBrowseClean feature failing to properly filter special elements in resource or file...

Vulnerability Spotlight: Vulnerabilities in Lantronix PremierWave 2050 could lead to code execution, file deletion

Matt Wiseman discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered multiple vulnerabilities in Lantronix’s PremierWave 2050, an embedded Wi-Fi module. There are several vulnerabilities in PremierWave 2050’s Web Manager, a web-accessible application that... This is...

Microsoft Windows Update Assistant 权限许可和访问控制问题漏洞

Microsoft Windows Update Assistant, a system update tool from Microsoft Corporation, contains an elevation of privilege vulnerability that stems from a lack of filtering and restriction on privilege handling, which could be exploited by an attacker to The vulnerability is caused by a lack of...

ResourceSpace directory traversal vulnerability

ResourceSpace is a digital asset management tool that enables users to organize their digital assets. a directory traversal vulnerability exists in ResourceSpace. An attacker could exploit the vulnerability to delete arbitrary files on the ResourceSpace server via the provider and variant...

CVE-2021-41950

A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the...

CVE-2021-41950

A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the...

CVE-2021-41950

ResourceSpace 9.6 is affected by a directory traversal vulnerability (CVE-2021-41950) that allows remote unauthenticated attackers to delete arbitrary files on the server via the provider and variant parameters in pages/ajax/tiles.php, potentially taking the application offline. Affected versions...

CVE-2021-41950: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the...

PT-2021-23456 · Unknown · Resourcespace

Name of the Vulnerable Software and Affected Versions: ResourceSpace versions 9.6 through 9.6 rev 18277 Description: A directory traversal issue allows remote unauthenticated attackers to delete arbitrary files on the server via the provider and variant parameters in "pages/ajax/tiles.php"...

Montala ResourceSpace 路径遍历漏洞

ResourceSpace is a digital asset management tool that enables users to organize their digital assets. a directory traversal vulnerability exists in ResourceSpace. An attacker could exploit the vulnerability to delete arbitrary files on the ResourceSpace server via the provider and variant...

Lantronix PremierWave 2050 Web Manager FsBrowseClean directory traversal vulnerability

Summary A directory traversal vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 in QEMU. A specially crafted HTTP request can lead to arbitrary file deletion. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Debian DSA-5004-1 : libxstream-java - security update

The remote Debian 10 / 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5004 advisory. Multiple security vulnerabilities have been discovered in XStream, a Java library to serialize objects to XML and back again. These vulnerabilities may allow...

Backup and Restore <= 1.0.3 - Admin+ Arbitrary File Deletion

The plugin does not sanitise and validate the foldername parameter when deleting a report, which could allow high privilege users to delete arbitrary files on the web server, including those outside of the WordPress folder PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language:...

WordPress Backup And Restore 1.0.3 Arbitrary File Deletion

Exploit Title: WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion Date: 11/07/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: https://www.miniorange.com/ Software Link: https://wordpress.org/plugins/backup-and-restore-for-wp/ Version: 1.0.3 Tested on : Window...

Backup and Restore <= 1.0.3 - Admin+ Arbitrary File Deletion

The plugin does not sanitise and validate the foldername parameter when deleting a report, which could allow high privilege users to delete arbitrary files on the web server, including those outside of the WordPress folder POST /wp-admin/admin-ajax.php HTTP/1.1 Accept: / Accept-Language:...

WordPress Backup and Restore 1.0.3 Plugin - Arbitrary File Deletion Vulnerability

Exploit Title: WordPress Plugin Backup and Restore 1.0.3 - Arbitrary File Deletion Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: https://www.miniorange.com/ Software Link: https://wordpress.org/plugins/backup-and-restore-for-wp/ Version: 1.0.3 Tested on : Windows 10 Poc:...