13364 matches found
GHSA-H5G4-PPWX-48Q2 Missing validation causes denial of service via `DeleteSessionTensor`
Impact The implementation of tf.rawops.DeleteSessionTensor does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf handle = tf.constant"", shape=0, dtype=tf.string...
EC-CUBE Cross-site request forgery (CSRF) vulnerability
Cross-site request forgery CSRF vulnerability in EC-CUBE 2 series 2.11.0 to 2.17.1 allows a remote attacker to hijack the authentication of Administrator and delete Administrator via a specially crafted web page...
GHSA-GPMF-Q5JH-HJX4 Grav CMS Arbitrary File Deletion
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection...
CSRF vulnerability in Jenkins Shelve Project Plugin
Jenkins Shelve Project Plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to shelve, unshelve, or delete a project. Jenkins Shelve Project Plugin 3.1 requires POST requests f...
GHSA-HX79-X87C-HGM3 EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...
EC-CUBE Directory traversal vulnerability
Directory traversal vulnerability in EC-CUBE 3.0.0 to 3.0.18 and 4.0.0 to 4.0.3 allows remote authenticated attackers to delete arbitrary files and/or directories on the server via unspecified vectors...
GHSA-2CXG-448H-4WXJ Jenkins Support Core Plugin allowed users with Overall/Read permission to delete arbitrary files
Jenkins Support Core Plugin did not validate the paths submitted for the "Delete Support Bundles" feature. This allowed users to delete arbitrary files on the Jenkins controller file system accessible to the OS user account running Jenkins. Additionally, this endpoint did not perform a permission...
Missing permission check in Jenkins Support Core Plugin
A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles...
GHSA-J52R-PMQV-WM38 Missing permission check in Jenkins Support Core Plugin
A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles...
GHSA-2MG9-HV69-897X Moodle Ability to delete glossary entries that belong to another glossary
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to...
phpMyAdmin CSRF Vulnerability
An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken tag pointing at the victim's phpMyAdmin database, and the attacker can potential...
CVE-2022-30843
Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=deletecategory, id...
CVE-2022-30843
Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=deletecategory, id...
Sql injection
Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=deletecategory, id...
CVE-2022-30461
Water-billing-management-system v1.0 is vulnerable to SQL Injection via /wbms/classes/Master.php?f=deleteclient, id...
CVE-2022-30463
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=deleteproduct...
CVE-2022-30463
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=deleteproduct...
CVE-2022-30459
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simplechatbot/classes/Master.php?f=deleteresponse, id...