Design/Logic Flaw

Time of Check - Time of Use TOCTOU vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between detecting a file as malicious and when th...

CVE-2022-31466 TOCTOU Vulnerability in Quick Heal Total Security

Time of Check - Time of Use TOCTOU vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between detecting a file as malicious and when th...

Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files...

Chain Sea Ai Chatbot System Path Traversal Vulnerability

Chain Sea Ai Chatbot System is an intelligent customer service software from Chain Sea, a Chinese company. An attacker could download arbitrary system files without authentication...

Telesquare TLR-2005Ksh Arbitrary File Deletion Vulnerability

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from Telesquare Korea. An arbitrary file deletion vulnerability exists in Telesquare TLR-2005Ksh version 1.0.0, which stems from improper access control. A remote attacker can exploit this vulnerability to delete any file, even internal system...

CVE-2021-46424

Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request...

CVE-2022-20789

A vulnerability in the software upgrade process of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an authenticated, remote attacker to write arbitrary files on the affected system. This vulnerability i...

IBM Aspera High-Speed Transfer信息泄露漏洞

IBM Aspera is a fast file transfer and streaming solution built on the IBM FASP protocol from IBM U.S.A. An information disclosure vulnerability exists in IBM Aspera High-Speed Transfer, which could be exploited by attackers to obtain information from non-sensitive operating system files to which...

CVE-2022-22391

IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059...

IBM Aspera 信息泄露漏洞

IBM Aspera is a fast file transfer and streaming solution built on the IBM FASP protocol from IBM U.S.A. An information disclosure vulnerability exists in IBM Aspera High-Speed Transfer, which could be exploited by attackers to obtain information from non-sensitive operating system files to which...

Samsung SMR Access Control Error Vulnerability (CNVD-2022-63645)

Samsung SMR is a system patch package from South Korea's Samsung Samsung. It provides patches for Samsung mobile applications.Samsung SMR suffers from an access control error vulnerability, which stems from incorrect access control and path traversal in StroageManager and StroageManagerService. A...

CVE-2022-22391

IBM Aspera High-Speed Transfer 4.3.1 and earlier could allow an authenticated user to obtain information from non sensitive operating system files that they should not have access to. IBM X-Force ID: 222059...

Path traversal

Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers to access arbitrary system files without a proper permission. The patch adds proper validation logic to prevent arbitrary files access...

CVE-2022-27836

CVE-2022-27836 impacts Samsung Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1, due to improper access control and path traversal. This allows local attackers to access arbitrary system files; the patch adds validation logic to prevent arbitrary file access (security u...

CVE-2022-27836

Improper access control and path traversal vulnerability in Storage Manager and Storage Manager Service prior to SMR Apr-2022 Release 1 allow local attackers to access arbitrary system files without a proper permission. The patch adds proper validation logic to prevent arbitrary files access...

CVE-2021-46419

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts...

Arbitrary file deletion

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts...

CVE-2021-46419

An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts...

CVE-2021-46419

CVE-2021-46419 affects the Telesquare TLR-2855KS6. The publicly documented vector is an unauthenticated HTTP DELETE request to potentially delete arbitrary files on the device (example PoC targets /cgi-bin/test.cgi), which can destroy system files and render the device inoperable. The issue is ex...

Hiby Music Hiby OS R3 Pro Directory Traversal Vulnerability

Hiby Music Hiby OS R3 Pro is a portable music player from Hiby Music, a Chinese company. Hiby Music Hiby OS R3 Pro is vulnerable to a directory traversal vulnerability, which could be exploited by attackers to view the device's system files via HTTP...