128 matches found
CVE-2023-28318
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
Arbitrary file deletion
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
CVE-2023-28318
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
CVE-2023-28318
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
CVE-2023-28318
CVE-2023-28318 affects Rocket.Chat. The vulnerability allows hiding messages and deletion notices regardless of Message_KeepHistory or Message_ShowDeletedStatus server configuration, bypassing intended deletion behavior. The core issue is an authorization/visibility flaw in Rocket.Chat that lets ...
GHSA-2WMJ-8MQG-R9Q8 Moodle has Incorrect Default Permissions
In Moodle, insufficient capability checks meant message deletions were not limited to the current user...
Design/Logic Flaw
In Moodle, insufficient capability checks meant message deletions were not limited to the current user...
UBUNTU-CVE-2021-36397
In Moodle, insufficient capability checks meant message deletions were not limited to the current user...
CVE-2021-36397
In Moodle, insufficient capability checks meant message deletions were not limited to the current user...
CVE-2022-43673
Summary of CVE-2022-43673 : Wire (Windows, up to version 3.22.3993) stores chat messages in AppData\Roaming\Wire\IndexedDB\https_app.wire.com_0.indexeddb.leveldb. Although the UI advertises deletion, the messages remain retrievable for a limited time, enabling information disclosure of sent messa...
CVE-2022-27850 WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF in Simple Ajax Chat WordPress plugin = 20220115 allows an attacker to clear the chat log or delete a chat message...
Simple Ajax Chat < 20220216 - Log Clearing & Arbitrary Chat Message Deletion via CSRF
The plugin does not have CSRF check in place when clearing chat logs and deleting a chat message, which could allow attackers to make a logged in admin perform such actions via a CSRF attack...
CVE-2022-23605
Wire webapp is a web client for the wire messaging protocol. In versions prior to 2022-01-27-production.0 expired ephemeral messages were not reliably removed from local chat history of Wire Webapp. In versions before 2022-01-27-production.0 ephemeral messages and assets might still be accessible...
Cross-Site Request Forgery (CSRF) in gunet/openeclass
Description No CSRF is provided when deleting messages. Proof of Concept The attacker could delete a specific message as they are generated consecutively and brute forcing it. history.pushState'', '', '/' or the could just delete all the messages: history.pushState'', '', '/' Impact Combining thi...
Rocket.Chat: Messages can be hidden regardless of server configuration
Vulnerability description not provided...
Cross site request forgery (csrf)
Cross Site Request Forgery CSRF vulnerability exists in v2.0.0 in videolist.php, which can let a malicious user delete a video message...
Cross-Site Request Forgery (CSRF) in tsolucio/corebos
✍️ Description Attacker able to delete any Message with CSRF attack because there is any CSRF protection for related endpoint. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the I...
Cybozu Garoon message deletion vulnerability
A message deletion vulnerability exists in Cybozu Garoon, a portal-based OA office system of Cybozu Japan. An attacker can use this vulnerability to delete workflow routing information without the appropriate privileges...
Cybozu Garoon 输入验证错误漏洞
A message deletion vulnerability exists in Cybozu Garoon, a portal-based OA office system of Cybozu Japan. An attacker can use this vulnerability to delete workflow routing information without the appropriate privileges...
Moodle 安全漏洞
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from insufficient permission checking when deleting messages. A remote user can...