Arbitrary file deletion

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request...

CVE-2022-25591

BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request...

GHSA-44P8-C3WV-F28R Directory Traversal in Studio 42 elFinder

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue...

Directory Traversal in Studio 42 elFinder

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue...

elFinder Path Traversal vulnerability

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

GHSA-45X3-MW7Q-WF7F elFinder Path Traversal vulnerability

Studio 42 elFinder before 2.1.36 has a directory traversal vulnerability in elFinder.class.php with the zipdl function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22777

TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability Original release date:May 18, 2022 Last revised: --- CVE-2022-22777 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The followi...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22777

TIBCO BusinessConnect Trading Community Management Reflected Cross Site Scripting Vulnerability Original release date:May 18, 2022 Last revised: --- CVE-2022-22777 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The followi...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22778

TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability Original release date: May18, 2022 Last revised: --- CVE-2022-22778 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The following...

TIBCO Security Advisory: May 18, 2022 - TIBCO BusinessConnect Trading Community Management-CVE-2022-22778

TIBCO BusinessConnect Trading Community Management Cross-Site Request Forgery Vulnerability Original release date: May18, 2022 Last revised: --- CVE-2022-22778 Source: TIBCO Software Inc. Products Affected TIBCO BusinessConnect Trading Community Management versions 6.1.0 and below The following...

B&R Automation Runtime 安全漏洞

B&R Automation Runtime is a major component of AS from B&R Automation, an Austrian company. A security vulnerability exists in B&R Automation Runtime versions prior to 4.91 that stems from improper buffer limits in the web server. Exploitation of the vulnerability by an unauthenticated attacker...

Cambium Networks cnMaestro Operating System Command Injection Vulnerability

Cambium Networks cnMaestro is a cloud-based or native software platform from Cambium Networks for secure end-to-end network control. Cambium Networks cnMaestro suffers from an operating system command injection vulnerability. An attacker could exploit this vulnerability to access the cnMaestro...

CVE-2021-27770

The vulnerability was discovered within the “FaviconService”. The service takes a base64-encoded URL which is then requested by the webserver. We assume this service is used by the “meetings”-function where users can specify an external URL where the online meeting will take place...

CVE-2022-26780

Multiple improper input validation vulnerabilities exists in the libnvram.so nvramimport functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.An improper input...

CVE-2022-21809

A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability...

InHand Networks InRouter302 缓冲区错误漏洞

InHand Networks InRouter Series is a series of routers from InHand Networks, U.S.A. A buffer overflow vulnerability exists in InHand Networks InRouter302 version V3.5.4, which stems from the httpd parsepingresult API function A boundary error occurs when handling untrusted input, which can be...

Siemens SICAM T 跨站脚本漏洞

The SICAM P850 Multifunctional Measurement Device is used to collect, visualize, evaluate and transmit electrical measurement variables such as AC current, AC voltage, frequency, power, harmonics, etc. The SICAM P855 Multifunctional Device is used to collect, display and transmit measured...

Cambium Networks cnMaestro 操作系统命令注入漏洞

Cambium Networks cnMaestro is a cloud-based or native software platform from Cambium Networks for secure end-to-end network control. Cambium Networks cnMaestro suffers from an operating system command injection vulnerability. An attacker could exploit this vulnerability to access the cnMaestro...

PT-2022-9858 · Hcl +1 · Sametime

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue was discovered within the FaviconService, which takes a base64-encoded URL and requests it through the webserver. It is assumed that this...

PT-2022-18083 · Unknown · Inrouter302

Name of the Vulnerable Software and Affected Versions: InRouter302 version 3.5.4 Description: The issue is related to improper input validation vulnerabilities in the libnvram.so nvram import functionality and the httpd's user define set item function. A specially-crafted file can lead to remote...