CVE-2024-38657

CRITICAL Year: 2024
CVSS v3 Score
9.1
Critical
Weakness Type
CWE-73
View all →

Vulnerability Description

External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.

Related Vulnerabilities

CVE-2024-10834

CRITICAL
CVSS:9.1(Critical)

eosphoros-ai/db-gpt version 0.6.0 contains a vulnerability in the RAG-knowledge endpoint that allows for arbitrary file write. The issue arises from the ability to pass an absolute path to a call to `...

CWE-732024

CVE-2024-10902

CRITICAL
CVSS:9.1(Critical)

In eosphoros-ai/db-gpt version v0.6.0, the web API `POST /v1/personal/agent/upload` is vulnerable to Arbitrary File Upload with Path Traversal. This vulnerability allows unauthorized attackers to uplo...

CWE-732024

CVE-2024-6829

CRITICAL
CVSS:9.1(Critical)

A vulnerability in aimhubio/aim version 3.19.3 allows an attacker to exploit the `tarfile.extractall()` function to extract the contents of a maliciously crafted tarfile to arbitrary locations on the ...

CWE-732024

CVE-2025-2004

CRITICAL
CVSS:9.1(Critical)

The Simple WP Events plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpe_delete_file AJAX action in all versions up to, and including, 1.8...

CWE-732025

CVE-2025-2409

HIGH
CVSS:9.1(Critical)

File corruption vulnerabilities in ASPECT provide attackers access to overwrite sys-tem files if session administrator credentials become compromised This issue affects ASPECT-Enterprise: through 3.08...

CWE-732025

CVE-2025-4603

CRITICAL
CVSS:9.1(Critical)

The eMagicOne Store Manager for WooCommerce plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_file() function in all versions up to, ...

CWE-732025