121 matches found
Checkmk 2.0.x < 2.1.0p37, 2.2.x < 2.2.0p15 Multiple Vulnerabilities
Checkmk is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:checkmk:checkmk"; if description...
Design/Logic Flaw
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...
CVE-2023-4023 All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...
CVE-2023-4023
CVE-2023-4023 – All Users Messenger (WordPress) vulnerability : The All Users Messenger plugin (≤1.24) allows non-administrator users with Subscriber privileges to delete messages due to missing access control (IDOR). Descriptions across connected sources confirm the issue as a broken-access-cont...
CVE-2023-4023 All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR
The All Users Messenger WordPress plugin through 1.24 does not prevent non-administrator users from deleting messages from the all-users messenger...
PT-2023-27340 · WordPress · All Users Messenger
Name of the Vulnerable Software and Affected Versions: All Users Messenger WordPress plugin versions 1.24 and earlier Description: The issue concerns the All Users Messenger WordPress plugin, where non-administrator users can delete messages from the all-users messenger due to a lack of proper...
CVE-2023-4105 Attachment of deleted message in a thread remains accessible and downloadable
Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...
Mattermost Security Vulnerabilities
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that arises from the deletion of a message in a thread without the attachment being deleted, allowing normal users to still access and download the...
All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR
Description The plugin does not prevent non-administrator users from deleting messages from the all-users messenger. PoC 1 Go to the messenger 2 Catch a request that is constantly running at intervals of 3 seconds 3 Change the message time argument to true 4 Set true for permission to delete a...
All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR
Description The plugin does not prevent non-administrator users from deleting messages from the all-users messenger. 1 Go to the messenger 2 Catch a request that is constantly running at intervals of 3 seconds 3 Change the message time argument to true 4 Set true for permission to delete a commen...
PT-2023-22685 · Apache · Apache Pulsar Broker
Name of the Vulnerable Software and Affected Versions: Apache Pulsar Broker versions 2.9.0 through 2.9.5 Apache Pulsar Broker versions 2.10.0 through 2.10.3 Apache Pulsar Broker version 2.11.0 Description: The issue is related to an Incorrect Authorization vulnerability in Apache Pulsar Broker's...
Rocket.Chat: IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message ID
The vulnerability discovered was an IDOR Insecure Direct Object Reference vulnerability. The issue allowed a user to delete messages in a channel they had been banned from or left, using the message ID obtained from a previous message sent in the channel. This vulnerability existed because the...
CVE-2023-32310
CVE-2023-32310 affects DataEase, where the API endpoints for deleting dashboards and deleting system messages are vulnerable to insecure direct object references (IDOR). The flaw could allow a user to delete another user’s dashboard or messages or interfere with marking messages read. Affected ve...
CVE-2023-28318
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
Arbitrary file deletion
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
CVE-2023-28318
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
CVE-2023-28318
A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...
CVE-2023-28318
CVE-2023-28318 affects Rocket.Chat. The vulnerability allows hiding messages and deletion notices regardless of Message_KeepHistory or Message_ShowDeletedStatus server configuration, bypassing intended deletion behavior. The core issue is an authorization/visibility flaw in Rocket.Chat that lets ...