PYSEC-2023-200

vantage6 is privacy preserving federated learning infrastructure. When a collaboration is deleted, the linked resources such as tasks from that collaboration should be deleted. This is partly to manage data properly, but also to prevent a potential but unlikely side-effect that affects versions...

Easy WP Cleaner <= 1.9 - Data Deletion via CSRF

Description The plugin does not have CSRF check when deleting data from the blog, which could allow attackers to make logged in admins perform such action via a CSRF attack...

CVE-2023-4828: Improper Check for Unusual or Exceptional Conditions

An improper check for an exceptional condition in the Insider Threat Management ITM Server could be used by an attacker to change the server's configuration of any already-registered agent so that the agent sends all future communications to an attacker-chosen URL. This could result in disclosure...

Oracle VM VirtualBox Core Component Data Access

The vulnerability of the Core component of the Oracle VM VirtualBox software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to read, modify, or delete data...

Oracle VM VirtualBox Core Component Data Access

The vulnerability of the Core component of the Oracle VM VirtualBox software lies in insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to read, modify, or delete data...

SAP NetWeaver AS for Java Log Viewer Data Access

The vulnerability of the Log Viewer component of the SAP NetWeaver AS for Java software platform is related to incorrect processing of data written to registration logs. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, or delete data by...

CVE-2023-33852

IBM Security Guardium 11.4 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 257614...

India Passes New Digital Personal Data Protection Bill (DPDPB), Putting Users' Privacy First

The Indian President Droupadi Murmu on Friday granted assent to the Digital Personal Data Protection Bill DPDPB after it was unanimously passed by both houses of the parliament last week, marking a significant step towards securing people's information. "The Bill provides for the processing of...

SAP Business One Layer Data Access

The vulnerability of component B1i Layer in the SAP Business One resource management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to remotely gain access to read, modify, or delete data by sending...

CVE-2023-39962

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external...

CVE-2023-39962: Improper Access Control

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 19.0.0 and prior to versions 19.0.13.10, 20.0.14.15, 21.0.9.13, 22.2.10.14, 23.0.12.8, 24.0.12.5, 25.0.9, 26.0.4, and 27.0.1, a malicious user could delete any personal or global external...

VMware SD-WAN Edge Web Interface Bypass

The vulnerability of the web interface of microprogramming software in VMware SD-WAN Edge devices is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain read, modify, or delete access to data by downloading the...

Networking Component Java SE GraalVM Enterprise Edition Privilege Escalation

The vulnerability of the Networking component of the Java SE software platform and the Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK virtual machines is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to gain access to, modify, add, o...

Analytics Server component of DoS

The vulnerability of the Analytics Server component of the Oracle Business Intelligence Enterprise Edition software is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to gain access to, modify, add, or delete data, or cause service interruptions...

Core server component Oracle WebLogic Server Data Modification DoS

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, is related to errors in processing input data. Exploiting this vulnerability can allow an attacker to gain access to modify, add, or delete data, or cause service failures...

Oracle Business Intelligence Enterprise Edition Analytics Server Data Access

The vulnerability of the Analytics Server component of the Oracle Business Intelligence Enterprise Edition software is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to read, modify, add, or delete data...

Medtronic Paceart Optima 代码问题漏洞

Medtronic Paceart Optima is a comprehensive workflow solution from Medtronic, Inc. to efficiently compile and manage patient cardiac device data. A security vulnerability exists in Medtronic Paceart Optima version 1.11 and prior versions that originates from a data deserialization issue in...

CVE-2023-31222: Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device causing data to be deleted, stolen, or...

Zephyr Project Manager < 3.3.94 - Plugin Data Deletion via CSRF

The plugin does not have CSRF check when deleting its data, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...

Amazon Linux 2 : webkitgtk4 (ALAS-2023-2088)

The version of webkitgtk4 installed on the remote host is prior to 2.38.5-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2088 advisory. 2024-08-28: CVE-2022-22620 was added to this advisory. 2024-08-14: CVE-2022-32893 was added to this advisory. A logic...