Feb. 1, 2023, 3:15 a.m. |

National Vulnerability Database web.nvd.nist.gov

OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. This is possible because the application uses an unsanitized attacker-controlled parameter to construct an internal path.

application cve delete external files internal local parameter path server version

SOC 2 Manager, Audit and Certification

@ Deloitte | US and CA Multiple Locations

Werkstudent (w/m/d) - Cyber Security

@ IONOS | Karlsruhe, Germany

Security Operations Manager

@ BambooHR | Utah | Hybrid

Senior Risk and Compliance Analyst

@ Cricket.com | Hyderabad

Cyber Security Architect

@ Lilium | Munich

Senior Security Analyst

@ BETSOL | Bengaluru, India