Code injection

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

CVE-2020-13359

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are =12.10, =13.4, =13.5, 13.5.2...

foreman: Recover of plaintext password or token for the compute resources

It was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control over compu...

Multiple Lexmark Product Input Validation Vulnerabilities

Lexmark is an American developer and manufacturer of printers. An input validation vulnerability exists in multiple Lexmark products, which could be exploited by an attacker to perform a delete operation...

Critical Flaw Reported In phpMyAdmin Lets Attackers Damage Databases

A critical security vulnerability has been reported in phpMyAdmin—one of the most popular applications for managing the MySQL database—which could allow remote attackers to perform dangerous database operations just by tricking administrators into clicking a link. Discovered by an Indian security...

SAP Point of Sale Xpress Server Authentication Bypass Vulnerability

SAP Point of Sale POS is the German SAP SAP company's set of sales management system. Xpress Server is one of the Xpress server. A security vulnerability exists in the Xpress Server in SAP POS, which stems from the program's failure to require authentication. An attacker could use this...

NexusPHP Cross-Site Scripting Vulnerability (CNVD-2017-30114)

NexusPHP is a resource sharing community solution written in PHP developed by the Nexus team in China. A cross-site scripting vulnerability exists in NexusPHP version 1.5.beta5.20120707. A remote attacker can exploit this vulnerability by sending the 'returnto' parameter to the fun.php file durin...

DEBIAN-CVE-2017-5930

The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check...

WordPress WP Easy Slideshow Plugin 1.0.3 - Multiple Vulnerabilities

WP Easy Slideshow plugin is prone to multiple vulnerabilities, such as arbitrary file upload using CSRF and delete operation using CSRF vulnerabilities. Upload scripts allow to upload arbitrary files. Solution Update the plugin...

DEBIAN-CVE-2013-0179

The processbindelete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service segmentation fault via a request to delete a key, which does not account for the lack of a null terminator in the ke...

CVE-2013-0179

The processbindelete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service segmentation fault via a request to delete a key, which does not account for the lack of a null terminator in the ke...

Design/Logic Flaw

importbuddy.php in the BackupBuddy plugin 1.3.4, 2.1.4, 2.2.25, 2.2.28, and 2.2.4 for WordPress does not reliably delete itself after completing a restore operation, which makes it easier for remote attackers to obtain access via subsequent requests to this script...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an image action...

CVE-2011-4452

Cross-site request forgery CSRF vulnerability in the AdminUsers component in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to hijack the authentication of administrators for requests that remove arbitrary user accounts via a delete operation, as demonstrated by an image action...

mysql: Server crash on HANDLER READ NEXT after DELETE

MySQL 5.1.x before 5.1.62 and 5.5.x before 5.5.22 allows remote authenticated users to cause a denial of service assertion failure and mysqld abort by deleting a record and using HANDLER READ NEXT...

Session fixation

Pioneers formerly gnocatan before 0.11.3 allows remote attackers to cause a denial of service crash by triggering a delete operation while the Session object is still being used, as demonstrated by causing a "Broken pipe" error...

CVE-2006-6741

Cross-site request forgery CSRF vulnerability in urlobox in MKPortal allows remote attackers to delete arbitrary messages as an administrator via a delete operation in an img BBcode tag...

CVE-2006-6741

CVE-2006-6741 concerns a CSRF vulnerability in the urlobox component of MKPortal. The issue allows remote attackers to delete arbitrary administrator messages by triggering a delete operation embedded in an img BBcode tag. Affected software is MKPortal (specifically the urlobox feature); underlyi...