PT-2024-37610 · Unknown · Sourcecodester Simple Online Bidding System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Online Bidding System version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/ajax.php?action=delete user. The manipulation of the id argument leads to sql injection. The attack ma...

The vulnerability of the Delete component in the cloud software for creating and using Nextcloud Server’s data storage allows a attacker to cause a service failure.

The vulnerability of the “Delete” component in the cloud software for creating and using data storage for Nextcloud Server is related to lack of access control. Exploiting this vulnerability could allow an attacker to cause service interruptions...

The vulnerability of the Share component in the cloud software for creating and using Nextcloud Server’s data storage system allows a attacker to compromise the integrity of the data or cause service failures.

The vulnerability of the Share component in the cloud software for creating and using Nextcloud Server storage involves the sending of requests to delete old versions of files that could only be accessed with read permissions. Exploiting this vulnerability allows a malicious actor to compromise...

CVE-2024-6090

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerability can also be exploited to delete any files ending in .json on the target system, leading to a denial of service as users are unable to...

CVE-2024-6090 Path Traversal Vulnerability in gaizhenbiao/chuanhuchatgpt

A path traversal vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240410, allowing any user to delete other users' chat histories. This vulnerability can also be exploited to delete any files ending in .json on the target system, leading to a denial of service as users are unable to...

CVE-2024-6090

CVE-2024-6090 is a path traversal vulnerability in gaizhenbiao/chuanhuchatgpt (version 20240410). The underlying issue allows an attacker to delete other users’ chat histories and, per reports, any files ending in .json on the target system, which can cause a denial of service by breaking authent...

ROS-20240627-06

A vulnerability in the Calendar component of cloud storage creation and utilization software Nextcloud Server is related to improper access control. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive information Vulnerability in the 2FA component...

ChuanhuChatGPT Resource Management Error Vulnerability

ChuanhuChatGPT is a lightweight and easy-to-use Web GUI for ChatGPT/ChatGLM/LLaMA/StableLM/MOSS and many other LLMs. A resource management error vulnerability exists in ChuanhuChatGPT version 20240410, which stems from a susceptibility to a path traversal attack that allows any user to delete...

CVE-2024-5430

Removed by vendor...

CVE-2024-33879

An issue was discovered in VirtoSoftware Virto Bulk File Download 5.5.44 for SharePoint 2019. The Virto.SharePoint.FileDownloader/Api/Download.ashx isCompleted method allows arbitrary file download and deletion via absolute path traversal in the path parameter...

CVE-2024-3593

The UberMenu plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.3. This is due to missing or incorrect nonce validation on the ubermenudeleteallitemsettings and ubermenuresetsettings functions. This makes it possible for unauthenticated...

WordPress plugin UberMenu security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

AZL-42842 CVE-2024-38662 affecting package kernel for versions less than 5.15.162.2-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a mapdelete on a...

DEBIAN-CVE-2024-38662

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a mapdelete on a...

UBUNTU-CVE-2024-38662

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a mapdelete on a...

CVE-2024-38662 bpf: Allow delete from sockmap/sockhash only if update is allowed

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by performing a mapdelete on a...

CVE-2024-37353

CVE-2024-37353 is labeled as Rejected by its CNA in the initial document, but connected security feeds disclose a concrete Linux kernel issue in the virtio subsystem. The Nessus/NASL entry attributes the vulnerability to the virtio path: kernel: virtio: delete vq in vp_find_vqs_msix() when reques...

TYPO3 Security Vulnerabilities

TYPO3 is a free and open source content management system framework CMS/CMF from the Swiss TYPO3 Association. A security vulnerability exists in TYPO3 versions prior to 8.3.8, and 9.x versions prior to 9.0.6, which stems from the presence of an insecure direct object reference IDOR vulnerability,...

PT-2024-26786 · WordPress · Ubermenu

Name of the Vulnerable Software and Affected Versions: UberMenu plugin for WordPress versions up to, and including, 3.8.3 Description: The issue is due to missing or incorrect nonce validation on the ubermenu delete all item settings and ubermenu reset settings functions. This allows...

CVE-2024-6147

Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Poly Plantronics Hub. An attacker must first obtain the ability to execute low-privileged code on the target system in order ...