CVE-2020-3890

The issue was addressed with improved deletion. This issue is fixed in iOS 13.4 and iPadOS 13.4. Deleted messages groups may still be suggested as an autocompletion...

CVE-2020-18463

Cross Site Request Forgery CSRF vulnerability exists in v2.0.0 in videolist.php, which can let a malicious user delete a video message...

CVE-2020-6847

OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript...

WordPress Bulk Me Now plugin <= 2.0 - Message Deletion via CSRF vulnerability

Message Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Bulk Me Now! versions = 2.0...

CVE-2024-12709 Bulk Me Now <= 2.0 - Message Deletion via CSRF

The Bulk Me Now! WordPress plugin through 2.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

CVE-2024-12709

CVE-2024-12709 concerns the WordPress plugin Bulk Me Now! (versions ≤ 2.0). The issue is a lack of CSRF protections in certain paths, enabling attackers to trigger actions as logged-in users via CSRF. Several connected sources corroborate CSRF-related risk and, in Patch Stack, describe a CSRF-cau...

The vulnerability of the Mattermost instant messaging application, related to the absence of an authentication process that allows a malicious user to delete any message they want.

The vulnerability of the Mattermost instant messaging application is related to the absence of authentication procedures. Exploiting this vulnerability could allow a malicious actor to delete any message at will...

CVE-2024-11353 SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion

The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletemessage function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-11353 SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion

The SMS for Lead Capture Forms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deletemessage function in all versions up to, and including, 1.1.0. This makes it possible for authenticated attackers, with Subscriber-level access and...

WordPress SMS for Lead Capture Forms plugin <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Message Deletion vulnerability discovered by Mika in WordPress Plugin SMS for Lead Capture Forms versions = 1.1.0...

UBUNTU-CVE-2024-51488

Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users delete messages. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to delete messages to any...

CVE-2024-51488

CVE-2024-51488 affects Ampache; root cause is insufficient validation of CSRF tokens in the delete-message flow. This enables forging CSRF requests to delete messages for any user (including admins). Remediation: upgrade to Ampache 7.0.1 or later. If upgrading is not possible, apply vendor adviso...

PT-2024-34652 · Ampache · Ampache

Name of the Vulnerable Software and Affected Versions: Ampache versions prior to 7.0.1 Description: The issue concerns the inadequate validation of CSRF tokens in the token parsing implementation, which could be exploited to forge CSRF attacks. This allows an attacker to delete messages to any...

ROS-20240408-15

A vulnerability in the SSH protocol implementation is related to the ability to adjust packet sequence numbers during the connection negotiation process and remove an arbitrary number of SSH service messages. during the connection negotiation process and cause an arbitrary number of SSH service...

Checkmk 2.0.x < 2.1.0p37, 2.2.x < 2.2.0p15 Multiple Vulnerabilities

Checkmk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:checkmk:checkmk"; if description...

Design/Logic Flaw

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

CVE-2023-4023 All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

CVE-2023-4023

CVE-2023-4023 – All Users Messenger (WordPress) vulnerability : The All Users Messenger plugin (≤1.24) allows non-administrator users with Subscriber privileges to delete messages due to missing access control (IDOR). Descriptions across connected sources confirm the issue as a broken-access-cont...

CVE-2023-4023 All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...

PT-2023-27340 · WordPress · All Users Messenger

Name of the Vulnerable Software and Affected Versions: All Users Messenger WordPress plugin versions 1.24 and earlier Description: The issue concerns the All Users Messenger WordPress plugin, where non-administrator users can delete messages from the all-users messenger due to a lack of proper...