19053 matches found
CVE-2024-12071
The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletenetworkpost function in all versions up to, and including, 1.4.4. This makes it possible for...
CVE-2024-12071
The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the deletenetworkpost function in all versions up to, and including, 1.4.4. This makes it possible for...
CVE-2024-12071
CVE-2024-12071 affects the Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media WordPress plugin. The root cause is a missing capability check in delete_network_post(), present in all versions up to 1.4.4, enabling unauthenticated attackers to delete arbitrary posts...
PT-2025-1740 · WordPress · Evergreen Content Poster
Name of the Vulnerable Software and Affected Versions: The Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media plugin for WordPress versions up to, and including, 1.4.4 Description: The issue is related to unauthorized loss of data due to a missing capability check...
CVE-2024-55954 OpenObserve Improper Authorization Allows Admin User to Remove Root User
OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...
CVE-2024-55954
OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint "/api/orgid/users/emailid" allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...
WordPress Delete All Posts plugin <= 1.1.1 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Mika in WordPress Plugin Delete All Posts versions = 1.1.1...
D-Link DIR-816 security vulnerabilities
The D-Link DIR-816A2 is a router from China's AUO D-Link. The D-Link DIR-816A2 suffers from an Access Control Error vulnerability that stems from improper access control of the websURLFilterAddDel component, which can be exploited by an unauthenticated attacker to set up filtering rules via a...
PT-2025-3162
Name of the Vulnerable Software and Affected Versions OpenObserve versions prior to 0.14.1 Description A vulnerability in the user management endpoint /api/org id/users/email id allows an "Admin" role user to remove a "Root" user from the organization, violating the intended privilege hierarchy...
CVE-2024-48884
A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0...
CVE-2024-47566
A improper limitation of a pathname to a restricted directory 'path traversal' CWE-23 in Fortinet FortiRecorder version 7.2.0 through 7.2.1 and before 7.0.4 allows a privileged attacker to delete files from the underlying filesystem via crafted CLI requests...
libreswan: Invalid IKEv1 repeat IKE SA delete causes crash and restart
A NULL pointer dereference vulnerability was found in the Libreswan package. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the...
PT-2025-1318
Name of the Vulnerable Software and Affected Versions Fortinet FortiManager versions 7.4.0 through 7.4.2 Fortinet FortiManager versions prior to 7.2.5 Description A relative path traversal issue allows a privileged attacker to delete files from the underlying filesystem via crafted HTTP or HTTPS...
PT-2025-3151
Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 11.5.42 ELTS TYPO3 versions prior to 12.4.25 LTS TYPO3 versions prior to 13.4.3 LTS Description A vulnerability has been identified in the backend user interface functionality involving deep links, which is susceptible ...
TYPO3 security vulnerabilities
TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 that stems from the vulnerability of the back-end user interface deep-linking functionality to a cross-site request forgery attack, which allows a...
Path traversal in csfd daemon
An improper limitation of a pathname to a restricted directory vulnerability 'path traversal' CWE-22 in FortiManager, FortiOS, FortiProxy, FortiRecorder, FortiVoice and FortiWeb may allow a remote authenticated attacker with access to the security fabric interface and port to write arbitrary file...
CVE-2024-48884: Improper Limitation of a Pathname to a Restricted Directory
A improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.4, FortiOS 7.2.0 through 7.2.9, FortiOS 7.0...
CLSA-2025-1736778412 kernel: Fix of 17 CVEs
tracing: Free buffers when a used dynamic event is removed CVE-2022-49006 - ASoC: ops: Check bounds for second channel in sndsocputvolswsx CVE-2022-48951 - ext4: fix slab-use-after-free in ext4splitextentat CVE-2024-49884 - ext4: fix bug on in ext4escacheextent as ext4splitextentat failed...
CVE-2023-42231
Pat Infinite Solutions HelpdeskAdvanced = 11.0.33 is vulnerable to Incorrect Access Control. Low privileged users can delete admin users by sending a request to the "WSCView/Delete" function...