34 matches found
CVE-2026-16064: Incorrect Authorization
The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status o...
CVE-2026-14214: Improper Authentication
The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request...
The vulnerability of the vfs_worm module in Samba software allows a hacker to modify any arbitrary files.
The vulnerability of the vfsworm module in Samba software is related to improper handling of insufficient permissions or privileges. Exploiting this vulnerability allows a remote attacker to modify arbitrary files...
The vulnerability of the NTFS reparse point mechanism in Samba software, which allows a hacker to modify arbitrary files
The vulnerability of the NTFS reparse point mechanism in Samba software is related to access control deficiencies. Exploiting this vulnerability allows a remote attacker to modify arbitrary files...
CVE-2025-12071: Authorization Bypass Through User-Controlled Key
The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funpajaxmodifynotes' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with...
Race condition in xterm allows local users to modify arbitrary files via the logging option.
...
CVE-2025-42977: Improper Limitation of a Pathname to a Restricted Directory
SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentiality and a low impact on integrity...
The vulnerability of the Beta Access Utility component of the macOS operating system, related to vulnerabilities in access control, allows a malicious individual to modify arbitrary files.
The vulnerability of the Beta Access Utility component of the macOS operating system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to modify arbitrary files...
Archive_Tar: directory traversal due to inadequate checking of symbolic links
A flaw was found in the ArchiveTar package. ArchiveTar could allow a remote attacker to traverse directories on the system caused by inadequate checking of symbolic links. An attacker could send a specially-crafted URL request to the Tar.php script containing "dot dot" sequences /../ to modify...
The vulnerability of the Apache Struts software platform, related to deficiencies in access control, allows attackers to modify any arbitrary files.
The vulnerability of the Apache Struts software platform is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to modify arbitrary files remotely...
GHSA-9RJ9-5WCV-XGF2 Roundup Improper Access Control
The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as...
GHSA-V2GW-X5JF-PGWV Mercurial Directory traversal vulnerability
Directory traversal vulnerability in patch.py in Mercurial before 1.0.2 allows user-assisted attackers to modify arbitrary files via ".." dot dot sequences in a patch file...
CVE-2019-14397
cPanel before 80.0.5 allows demo accounts to modify arbitrary files via the extractfile API1 call SEC-496...
Cisco StarOS Remote Security Bypass Vulnerability
Cisco StarOS is the United States Cisco Cisco company's set of operating systems running in the 5000 and other series of router equipment. A remote security bypass vulnerability exists in Cisco StarOS, which can be exploited by a remote authenticated attacker to modify arbitrary files. The...
Cisco AnyConnect Secure Mobility Client IPC Command File Modification Vulnerability
Cisco AnyConnect Secure Mobility is a secure enterprise mobility solution. Cisco AnyConnect Secure Mobility Client fails to properly validate IPC commands, allowing a local attacker to exploit the vulnerability to modify arbitrary files with elevated privileges...
CVE-2015-6470: Undefined Security Weakness
Resource Data Management Data Manager before 2.2 allows remote authenticated users to modify arbitrary passwords via unspecified vectors...
CVE-2013-4431: Undefined Security Weakness
Mahara before 1.5.12, 1.6.x before 1.6.7, and 1.7.x before 1.7.3 does not properly prevent access to blocks, which allows remote authenticated users to modify arbitrary blocks via the bock id in an edit request...
CVE-2014-1934
tag.py in eyeD3 aka python-eyed3 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file...
