GestioIP 安全漏洞

GestioIP is a web-based IPv4/IPv6 address management software from GestioIP. A security vulnerability exists in GestioIP version v3.5.7, which stems from susceptibility to cross-site request forgery CSRF attacks that can lead to data modification, deletion, or disclosure...

CVE-2024-50858

CVE-2024-50858 affects GestioIP v3.5.7: multiple endpoints are vulnerable to CSRF, allowing an attacker to perform actions in an admin’s browser via a malicious URL, causing data modification, deletion or exfiltration. Public detail exists in Red Hat, NVD/NIST, CNNVD, PacketStorm, Exploit-DB, and...

CVE-2024-50858

Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery CSRF. An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration...

The vulnerability of the OpenVPN Connect software lies in the improper deletion of critical data at the boundary; this allows a hacker to increase their privileges.

The vulnerability of the OpenVPN Connect software is related to improper cross-border deletion of critical data. Exploiting this vulnerability can allow a remote attacker to increase their privileges...

CVE-2024-12855 AdForest - Classified Ads WordPress Theme <= 5.1.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post/Attachment Deletion

The AdForest theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions like 'sbremovead' in all versions up to, and including, 5.1.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12711 RSVP and Event Management <= 2.7.13 - Missing Authorization

The RSVP and Event Management plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX functions like bulkdeleteattendees and bulkdeletequestions in all versions up to, and including, 2.7.13. This makes it possible for unauthenticated attackers t...

CVE-2024-12158 Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Missing Authorization to Unauthenticated DB Table Truncation

The Popup – MailChimp, GetResponse and ActiveCampaign Intergrations plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'upcdeletedbdata' AJAX action in all versions up to, and including, 3.2.6. This makes it possible for unauthenticated...

The vulnerability of the CI/CD application deployment and integration teamcity backup file of JetBrains, which allows a hacker to expose user credentials and session cookie files.

The vulnerability of the CI/CD application deployment and integration team environment from JetBrains TeamCity is related to improper cross-border deletion of critical data. Exploiting this vulnerability can allow a malicious actor to access user credentials and cookie session files remotely...

CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Impact Affected versions of Winter CMS allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access vi...

CVE-2024-11354

CVE-2024-11354 concerns the WordPress plugin “Ultimate YouTube Video & Shorts Player With Vimeo”. The vulnerability affects all versions up to and including 3.3 and stems from a missing capability check in the del_ytsingvid() function, enabling authenticated attackers with Subscriber-level access...

CVE-2024-11069

The WordPress GDPR plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'WordPressGDPRDataDelete::checkaction' function in all versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to delete arbitrary users...

PT-2024-16734 · WordPress · Wordpress Gdpr Plugin

Name of the Vulnerable Software and Affected Versions: WordPress GDPR plugin versions up to, and including, 2.0.2 Description: The WordPress GDPR plugin is vulnerable to unauthorized loss of data due to a missing capability check on the WordPress GDPR Data Delete::check action function. This make...

CVE-2020-3539

A vulnerability in the web-based management interface of Cisco Data Center Network Manager DCNM could allow an authenticated, remote attacker to view, modify, and delete data without proper authorization. The vulnerability is due to a failure to limit access to resources that are intended for use...

The vulnerability of the virtual learning environment Moodle, related to the lack of authentication, allows a violator to delete data.

The vulnerability in the virtual learning environment Moodle is related to the lack of authentication. Exploiting this vulnerability could allow a malicious actor, operating remotely, to delete data...

Improper Privilege Management

Zope and AccessControl is vulnerable to Improper Privilege Management. The vulnerability is due to anonymous users being able to delete user data in AccessControl.userfolder.UserFolder, potentially preventing privileged access. Users unable to upgrade can mitigate by adding dataroles = to...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management due to the improper enforcement of access controls in the UserFolder component. An attacker can delete user data without proper authorization. Remediation Upgrade AccessControl to version 7.2 or higher...

GHSA-G5VW-3H65-2Q3V Access control vulnerable to user data deletion by anonynmous users

Impact Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. Patches The problem is fixed in version 7.2. Workarounds The problem can be fixed by adding dataroles = to AccessControl.userfolder.UserFolder. References...

CVE-2024-51734 User data deletion by anoynmous users in Zope

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...