13487 matches found
CVE-2021-22018: Undefined Security Weakness
The vCenter Server contains an arbitrary file deletion vulnerability in a VMware vSphere Life-cycle Manager plug-in. A malicious actor with network access to port 9087 on vCenter Server may exploit this issue to delete non critical files...
VulnCheck KEV: CVE-2022-1388
F5 BIG-IP contains a missing authentication in critical function vulnerability which can allow for remote code execution, creation or deletion of files, or disabling services...
VMware vCenter Server Appliance Update Manager Directory Traversal Arbitrary File Deletion Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on affected installations of VMware vCenter Server Appliance. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Update Manager. The issue results from the lack of proper validation...
VMware vCenter Server < 7.0 U2d Multiple Vulnerabilities (VMSA-2021-0020)
The version of VMware vCenter Server installed on the remote host is prior to 7.0 U2d. It is, therefore, affected by multiple vulnerabilities: - An unauthenticated API endpoint vulnerability exists in the vCenter Server Content Library. An unauthenticated, remote attacker can exploit this to...
VMware vCenter Server updates address multiple security vulnerabilities
3a. vCenter Server file upload vulnerability CVE-2021-22005 The vCenter Server contains an arbitrary file upload vulnerability in the Analytics service. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8. 3b. vCenter Server...
CVE-2021-24639
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server...
CVE-2021-24639: Missing Authorization
The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgfajaxemptydir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server...
PT-2021-16155 · WordPress · Omgf
Name of the Vulnerable Software and Affected Versions: OMGF WordPress plugin versions prior to 4.5.4 Description: The issue allows any authenticated users to delete arbitrary files or folders on the server due to the lack of path validation, authorisation, and CSRF checks in the omgf ajax empty d...
PT-2021-7472
Name of the Vulnerable Software and Affected Versions Moxa MXView affected versions not specified Description The issue is related to incorrect restriction of a directory path with limited access in the Moxa MXView network control software. Exploitation of this issue may allow a remote attacker t...
Arbitrary file deletion
An arbitrary file write vulnerability in RGCMS v1.06 allows attackers to execute arbitrary code via a crafted PHP file...
Cross site request forgery (csrf)
The Fileviewer WordPress plugin through 2.2 does not have CSRF checks in place when performing actions such as upload and delete files. As a result, attackers could make a logged in administrator delete and upload arbitrary files via a CSRF attack...
Cross-Site Request Forgery (CSRF) in microweber/microweber
Description Attacker able to delete any file In Files module if this module enabled there isn't any csrf protection in this endpoint. Proof of Concept After open the PoC.html file you can see that the file with name 1.jpg will be deleted. //PoC.html history.pushState'', '', '/'...
PT-2021-16014
Name of the Vulnerable Software and Affected Versions Fileviewer WordPress plugin versions through 2.2 Description The issue concerns the lack of CSRF checks in the Fileviewer WordPress plugin, allowing attackers to perform actions such as uploading and deleting files on behalf of a logged-in...
ECOA Building Automation System - Arbitrary File Deletion
Exploit Title: ECOA Building Automation System - Arbitrary File Deletion Date: 25.06.2021 Exploit Author: Neurogenesia Vendor Homepage: http://www.ecoa.com.tw ECOA Building Automation System Arbitrary File Deletion Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected...
ECOA Building Automation System Arbitrary File Deletion Vulnerability
ECOA building automation systems suffer from an arbitrary file deletion vulnerability. Many versions are affected. ECOA Building Automation System Arbitrary File Deletion Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS...
SUSE Linux Enterprise Server clone-master-clean-up.sh File Deletion
The vulnerability of the clone-master-clean-up.sh utility in the SUSE Linux Enterprise Server operating system is related to errors in link handling. Exploiting this vulnerability could allow a malicious actor to delete any files remotely...
ECOA Building Automation System Arbitrary File Deletion
Summary 1 The Risk-Terminator Web Graphic control BEMS Building Energy Management System are designed to provide you with the latest in the Human Machine Interface HMI technology, for completely monitoring and controlling management. It may be used singly for small and medium sized facilities,...
Aruba Operating System Cross-Site Request Forgery Vulnerability (CNVD-2021-77608)
Aruba Operating System is the operating system for Aruba controller-managed wireless LANs and Aruba mobile controllers from Aruba Networks, Inc. user interface to perform file deletion operations...
