MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery

Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Date: 2018-05-17 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 1. Description: The plugin allows moderators to save notes a...

MyBB Moderator Log Notes 1.1 Cross Site Request Forgery

Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Date: 2018-05-17 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 1. Description: The plugin allows moderators to save notes a...

CVE-2018-6830

Directory traversal vulnerability in Foscam Cameras C1 Lite V3, and C1 V3 with firmware 2.82.2.33 and earlier, FI9800P V3, FI9803P V4, FI9851P V3, and FI9853EP V2 2.84.2.33 and earlier, FI9816P V3, FI9821EP V2, FI9821P V3, FI9826P V3, and FI9831P V3 2.81.2.33 and earlier, C1, C1 V2, C1 Lite, and ...

LimeSurvey Cross-Site Request Forgery Vulnerability

LimeSurvey formerly known as PHPSurveyor is a set of open source online survey program developed by the LimeSurvey team, which supports survey program development, questionnaire distribution and data collection. A cross-site request forgery vulnerability exists in Boxes in LimeSurvey version...

CVE-2018-11092

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...

Cross site request forgery (csrf)

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...

CVE-2018-11092

An issue was discovered in the Admin Notes plugin 1.1 for MyBB. CSRF allows an attacker to remotely delete all admin notes via an admin/index.php?empty=table aka Clear Table action...

Monstra CMS File Deletion Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in Monstra CMS version 3.0.4. A remote attacker can send a message to...

CVE-2018-9850

In Gxlcms QY v1.0.0713, the Lib\Lib\Action\Admin\DataAction.class.php component exposes a directory traversal flaw in the id parameter of the Admin-Data-del request, enabling remote attackers to delete arbitrary files. This is documented across multiple sources (e.g., Red Hat, CVE records, CNVD)....

Authorization

IBM Business Process Manager 7.5.x, 8.0.x, 8.5.0, 8.5.5, and 8.5.6.0 through cumulative fix 2 allow remote authenticated users to delete process and task data by leveraging incorrect authorization checks. IBM X-Force ID: 108393...

CVE-2018-7237

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/setparam to the file name with the value of 'system.delete.sdfile'...

Design/Logic Flaw

A vulnerability exists in Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67 which could allow a remote attacker to delete arbitrary system file due to lack of validation of the /login/bin/setparam to the file name with the value of 'system.delete.sdfile'...

CVE-2017-16593

This vulnerability allows remote attackers to delete arbitrary files on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw...

CVE-2017-13984

An authentication vulnerability in HPE BSM Platform Application Performance Management System Health product versions 9.26, 9.30 and 9.40, allows remote users to delete arbitrary files via servlet directory traversal...

CVE-2017-12422

NetApp StorageGRID Webscale is affected. Versions 10.2.x prior to 10.2.2.3, 10.3.x prior to 10.3.0.4, and 10.4.x prior to 10.4.0.2 allow remote authenticated users to delete arbitrary objects via unspecified vectors. The primary impact is unauthorized deletion of objects; the underlying root caus...

Fiyo CMS Arbitrary File Deletion Vulnerability (CNVD-2017-26594)

Fiyo CMS is a content management system CMS for creating CMS templates. A security vulnerability exists in the dapur\apps\appconfig\controller\backuper.php file in Fiyo CMS version 2.0.7. The vulnerability can be exploited by a remote attacker to delete arbitrary files using the 'file' parameter ...

CVE-2017-11630

dapur\apps\appconfig\controller\backuper.php in Fiyo CMS 2.0.7 allows remote attackers to delete arbitrary files via directory traversal sequences in the file parameter in a type=database request, a different vulnerability than CVE-2017-8853...

DEBIAN-CVE-2016-7162

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

UBUNTU-CVE-2016-7162

The gfileremovedirectory function in file-utils.c in File Roller 3.5.4 through 3.20.2 allows remote attackers to delete arbitrary files via a symlink attack on a folder in an archive...

CVE-2016-4360

web/admin/data.js in the Performance Center Virtual Table Server VTS component in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patch 2, and 12.50 through patch 3 and Performance Center 11.52 through patch 3, 12.00 through patch 1, 12.01 through...