EUVD-2024-45361

Malicious code in bioql PyPI...

EUVD-2023-1734

Malicious code in bioql PyPI...

EUVD-2023-53916

Malicious code in bioql PyPI...

EUVD-2023-32025

Malicious code in bioql PyPI...

EUVD-2024-34005

Malicious code in bioql PyPI...

EUVD-2023-0836

Malicious code in bioql PyPI...

CVE-2024-11353

The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletemessage function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-51488

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users delete messages. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to delete messages to any...

CVE-2023-4023

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

CVE-2023-0487

The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2021-36397

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

CVE-2020-9988

The issue was addressed with improved deletion. This issue is fixed in macOS Big Sur 11.0.1, iOS 14.0 and iPadOS 14.0. A local user may be able to discover a user’s deleted messages...

CVE-2020-3890

The issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4. Deleted messages groups may still be suggested as an autocompletion...

CVE-2020-18463

Cross Site Request Forgery CSRF vulnerability exists in v2.0.0 in videolist.php, which can let a malicious user delete a video message...

CVE-2020-6847

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

WordPress Bulk Me Now plugin <= 2.0 - Message Deletion via CSRF vulnerability

Message Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Bulk Me Now! versions = 2.0...

CVE-2024-12709 Bulk Me Now <= 2.0 - Message Deletion via CSRF

The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-12709

CVE-2024-12709 concerns the WordPress plugin Bulk Me Now! (versions ≤ 2.0). The issue is a lack of CSRF protections in certain paths, enabling attackers to trigger actions as logged-in users via CSRF. Several connected sources corroborate CSRF-related risk and, in Patch Stack, describe a CSRF-cau...

The vulnerability of the Mattermost instant messaging application, related to the absence of an authentication process that allows a malicious user to delete any message they want.

The vulnerability of the Mattermost instant messaging application is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor to delete any message at will...

CVE-2024-11353 SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion

The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletemessage function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and...