PT-2023-27340 · WordPress · All Users Messenger

Name of the Vulnerable Software and Affected Versions: All Users Messenger WordPress plugin versions 1.24 and earlier Description: The issue concerns the All Users Messenger WordPress plugin, where non-administrator users can delete messages from the all-users messenger due to a lack of proper...

CVE-2023-4105 Attachment of deleted message in a thread remains accessible and downloadable

Mattermost fails to delete the attachments when deleting a message in a thread allowing a simple user to still be able to access and download the attachment of a deleted message...

Mattermost Security Vulnerabilities

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a security vulnerability that arises from the deletion of a message in a thread without the attachment being deleted, allowing normal users to still access and download the...

All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

Description The plugin does not prevent non-administrator users from deleting messages from the all-users messenger. PoC 1 Go to the messenger 2 Catch a request that is constantly running at intervals of 3 seconds 3 Change the message time argument to true 4 Set true for permission to delete a...

All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDOR

Description The plugin does not prevent non-administrator users from deleting messages from the all-users messenger. 1 Go to the messenger 2 Catch a request that is constantly running at intervals of 3 seconds 3 Change the message time argument to true 4 Set true for permission to delete a commen...

PT-2023-22685 · Apache · Apache Pulsar Broker

Name of the Vulnerable Software and Affected Versions: Apache Pulsar Broker versions 2.9.0 through 2.9.5 Apache Pulsar Broker versions 2.10.0 through 2.10.3 Apache Pulsar Broker version 2.11.0 Description: The issue is related to an Incorrect Authorization vulnerability in Apache Pulsar Broker's...

Rocket.Chat: IDOR vulnerability leads to Deleting message after leaving/getting banned from group using message ID

The vulnerability discovered was an IDOR Insecure Direct Object Reference vulnerability. The issue allowed a user to delete messages in a channel they had been banned from or left, using the message ID obtained from a previous message sent in the channel. This vulnerability existed because the...

CVE-2023-32310

CVE-2023-32310 affects DataEase, where the API endpoints for deleting dashboards and deleting system messages are vulnerable to insecure direct object references (IDOR). The flaw could allow a user to delete another user’s dashboard or messages or interfere with marking messages read. Affected ve...

CVE-2023-28318

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

Arbitrary file deletion

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

CVE-2023-28318

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

CVE-2023-28318

A vulnerability has been discovered in Rocket.Chat, where messages can be hidden regardless of the MessageKeepHistory or MessageShowDeletedStatus server configuration. This allows users to bypass the intended message deletion behavior, hiding messages and deletion notices...

CVE-2023-28318

CVE-2023-28318 affects Rocket.Chat. The vulnerability allows hiding messages and deletion notices regardless of Message_KeepHistory or Message_ShowDeletedStatus server configuration, bypassing intended deletion behavior. The core issue is an authorization/visibility flaw in Rocket.Chat that lets ...

GHSA-2WMJ-8MQG-R9Q8 Moodle has Incorrect Default Permissions

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

Design/Logic Flaw

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

UBUNTU-CVE-2021-36397

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

CVE-2021-36397

In Moodle, insufficient capability checks meant message deletions were not limited to the current user...

CVE-2022-43673

Summary of CVE-2022-43673 : Wire (Windows, up to version 3.22.3993) stores chat messages in AppData\Roaming\Wire\IndexedDB\https_app.wire.com_0.indexeddb.leveldb. Although the UI advertises deletion, the messages remain retrievable for a limited time, enabling information disclosure of sent messa...

CVE-2022-27850 WordPress Simple Ajax Chat plugin <= 20220115 - Multiple Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF in Simple Ajax Chat WordPress plugin = 20220115 allows an attacker to clear the chat log or delete a chat message...

Simple Ajax Chat < 20220216 - Log Clearing & Arbitrary Chat Message Deletion via CSRF

The plugin does not have CSRF check in place when clearing chat logs and deleting a chat message, which could allow attackers to make a logged in admin perform such actions via a CSRF attack...