Arbitrary file delete

...

NextGEN Gallery < 3.39 - Admin+ Arbitrary File Read and Delete

Description The plugin is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the galleryedit function, allowing an attacker to access arbitrary resources on the server. PoC 1. Create a Gallery called "My Gallery" and note its ID. 2. Run the following code...

CVE-2023-40623 Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)

SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the operating system files causing a limited...

Cisco Identity Services Engine 3.1.x < 3.1P6, 3.2.x < 3.2P2 Arbitrary File Delete and File Read (cisco-sa-ise-file-delete-read-PK5ghDDd)

According to its self-reported version, Cisco Identity Services is affected by a vulnerability in the web-based management interface. These allow an authenticated, remote attacker to delete or read arbitrary files on the underlying operating system. To exploit these vulnerabilities, an attacker...

CVE-2023-31178

AgilePoint NX v8.0 SU2.2 & SU2.3 – Arbitrary File Delete Vulnerability allows arbitrary file deletion, by an unspecified request...

CVE-2023-31178

AgilePoint NX v8.0 SU2.2 and SU2.3 are affected by an Arbitrary File Delete vulnerability. The issue allows deletion of arbitrary files via an unspecified request. Root cause is not detailed in the provided documents, and there is no explicit remediation or fix information in the connected sources.

CVE-2023-1412

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

CVE-2023-26957

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

CVE-2023-26957

CVE-2023-26957 affects onekeyadmin v1.3.9. The vulnerability exists in the component admin\controller\plugins and allows an arbitrary file deletion . The CVSS data indicates a network-based, unauthenticated, high-severity impact with integrity and availability both affected. No explicit remediati...

CVE-2023-26957

onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins...

PT-2023-14730 · Razer · Razercentral

Name of the Vulnerable Software and Affected Versions: Razer Central versions prior to 7.8.0.381 Description: The issue is related to an Arbitrary File Delete vulnerability when handling files in the Accounts directory. Recommendations: For versions prior to 7.8.0.381, update to version 7.8.0.381...

CVE-2022-45697

Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory...

CVE-2022-45697

CVE-2022-45697 affects Razer Central prior to v7.8.0.381, with an Arbitrary File Delete vulnerability when handling files in the Accounts directory. Impact details from the associated records indicate a local-only exposure with high impact on confidentiality, integrity, and availability (CVSS v3....

CVE-2023-23698

Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component. A local malicious user may potentially exploit this vulnerability leading to arbitrary file delete...

Design/Logic Flaw

Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component. A local malicious user may potentially exploit this vulnerability leading to arbitrary file delete...

CVE-2023-23698

Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in the installer component. A local malicious user may potentially exploit this vulnerability leading to arbitrary file delete...

CVE-2023-23698

Dell Command | Update, Dell Update, and Alienware Update prior to 4.6.0 and 4.7.1 are affected. The installer component performs an insecure operation on Windows Junction, allowing a local attacker to delete arbitrary files without user interaction. Impact: high for availability/integrity; exploi...

CVE-2022-42002

CVE-2022-42002 affects SonicJS up to version 0.6.0. The vulnerability stems from unauthenticated access to the file mutation mutations, specifically fileCreate and fileUpdate , which can overwrite arbitrary files on a SonicJS application. This leads to Arbitrary File Write and Delete . Connection...

CVE-2022-42002

SonicJS through 0.6.0 allows file overwrite. It has the following mutations that are used for updating files: fileCreate and fileUpdate. Both of these mutations can be called without any authentication to overwrite any files on a SonicJS application, leading to Arbitrary File Write and Delete...

Path traversal in Concrete CMS

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...