127 matches found
Directory Traversal, Arbitrary File Deletion Vulnerability in UsualToolCMS v8.0 Backend
UsualToolCMS UTCMS is an enterprise web content management system CMS based on PHP and MySQL. UsualToolCMS v8.0 backend has a directory traversal and arbitrary folder deletion vulnerability, an attacker can traverse to the root directory through the directory traversal vulnerability, and delete...
CVE-2019-5444
Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder...
CVE-2019-5444
Path traversal vulnerability in version up to v1.1.3 in serve-here.js npm module allows attackers to list any file in arbitrary folder...
Insert or Embed Articulate Content into WordPress <= 4.2999 - Authenticated Arbitrary Folder Deletion and Rename
The lack of CSRF, Authorisation and Path Traversal checks in wpajaxdeldir and wpajaxrenamedir AJAX methods in functions.php make it possible for an authenticated user with a role as low as subscriber to delete and rename arbitrary folders. CSRF attacks against such authenticated users is also...
Insert or Embed Articulate Content into WordPress plugin <= 4.2999 - Authenticated Arbitrary Folder Deletion and Rename
Authenticated Arbitrary Folder Deletion and Rename vulnerability found in Insert or Embed Articulate Content into WordPress plugin versions = 4.2999. Solution Update the Insert or Embed Articulate Content into WordPress plugin to the latest available version at least 4.29991...
Keybase: macOS privilege escalation
Short description We can add an arbitrary folder to the default $PATH environment variable, so we can exploit this to run arbitrary code as the targeted user. Steps to reproduce 1. In the example I will use the low privileged nobody account could be any other account and I will target the u3mur4...
CVE-2018-15963
Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation...
CVE-2018-15963
Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation...
CVE-2018-15963
Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation...
CVE-2018-15963
Adobe ColdFusion versions July 12 release 2018.0.0.310739, Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation...
October CMS Cross-Site Scripting Vulnerability (CNVD-2018-14215)
October CMS is an open source, self-hosted content management system CMS built on the Laravel PHP framework, developed by Canadian software developer Alexey Bobkov and Australian software developer Samuel Georges. The Media module is one of the media content management modules. A cross-site...
ASUSTOR AS6202T ADM path traversal vulnerability (CNVD-2018-10308)
ASUSTOR AS6202T ADM is a dedicated operating system for ASUSTOR NAS storage devices from ASUSTOR. A path traversal vulnerability exists in the fileExplorer.cgi file in ASUSTOR AS6202T ADM version 3.1.0.RFQ3. An attacker can exploit this vulnerability to create arbitrary folders with the help of t...
Monstra CMS 3.0.4 - Arbitrary Folder Deletion
Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request Date: 2018-03-26 Exploit Author: Wenming Jiang Vendor Homepage: https://github.com/monstra-cms/monstra Software Link: https://github.com/monstra-cms/monstra Version: 3.0.4 Tested on: macos 10.12.6, php 5....
Arbitrary Folder Deletion Vulnerability in HYBBS Community Forum System Version 2.1.3
HYBBS is a MVC-structured program based on HYPHP framework. HYBBS Community Forum System version 2.1.3 has an arbitrary folder deletion vulnerability. An attacker can exploit this vulnerability to delete arbitrary folders, resulting in a system crash...
Node.js third-party modules: [serve] Directory index of arbitrary folder available due to lack of sanitization of %2e and %2f characters in url
Hi, This report is about Arbitrary Directory Listing vulnerability I found in serve module. Vulnerability does not allow to open arbitrary file due to send module which handles file reading and implements its own validation and protection against Path Traversal attacks. However serve handles...
Jojo Xinha Path Traversal Vulnerability
Jojo is Jojo team developed a free, open source PHP-based content management system CMS. The system supports WYSIWYG editor , search engine optimization , etc. Xinha is used in one of the visual HTML editor . A directory traversal vulnerability exists in the plugins/ImageManager/backend.php file ...
Design/Logic Flaw
MobileStorageMounter in Apple iOS before 8.2 and Apple TV before 7.1 does not delete invalid disk-image folders, which allows attackers to create folders in arbitrary filesystem locations via a crafted app...
vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion / SQL Injection / Cross-Site Scripting
Exploit Title: vBulletin MicroCART 1.1.4 - Arbitrary Files Deletion, SQL Injection & XSS Date: January 8, 2015 Exploit Author: Technidev https://technidev.com Vendor Homepage: https://vbulletin.com Software Link: http://www.vbulletin.org/forum/showthread.php?t=256723 Version: 1.1.4 This plugin is...
Ultra Electronics 7.2.0.19 and 7.4.0.7 - Multiple Vulnerabilities
No description provided by source. Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...
Ultra Electronics / AEP Networks - SSL VPN (Netilla / Series A / Ultra Protect) Vulnerabilities
Ultra Electronics / AEP Networks - SSL VPN Netilla / Series A / Ultra Protect Vulnerabilities http://www.osisecurity.com.au/advisories/ultra-aep-netilla-vulnerabilities Release Date: 02-Oct-2014 Software: Ultra Electronics - Series A...