CVE-2024-3761

In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at packages/backend/src/api/v1/datasets is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a datas...

CVE-2024-3761

In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at packages/backend/src/api/v1/datasets is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a datas...

CVE-2024-3761 Missing Authorization on Delete Datasets in lunary-ai/lunary

In lunary-ai/lunary version 1.2.2, the DELETE endpoint located at packages/backend/src/api/v1/datasets is vulnerable to unauthorized dataset deletion due to missing authorization and authentication mechanisms. This vulnerability allows any user, even those without a valid token, to delete a datas...

CVE-2024-3761

In lunary-ai/lunary, version 1.2.2 contains an unauthorized deletion vulnerability on the DELETE endpoint at packages/backend/src/api/v1/datasets due to missing authorization/authentication. This allows any user (no token required) to delete a dataset, potentially causing data loss or service dis...

CVE-2024-5134

A vulnerability was found in SourceCodester Electricity Consumption Monitoring Tool 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-bill.php. The manipulation of the argument bill leads to sql injection. The attack can be initiated...

CVE-2024-5134 SourceCodester Electricity Consumption Monitoring Tool delete-bill.php sql injection

A vulnerability was found in SourceCodester Electricity Consumption Monitoring Tool 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /endpoint/delete-bill.php. The manipulation of the argument bill leads to sql injection. The attack can be initiated...

Mozilla: IndexedDB files retained in private browsing mode

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: If the browser.privatebrowsing.autostart preference is enabled, IndexedDB files were not properly deleted when the window was closed. This preference is disabled by default in Firefox...

PT-2024-27674 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions 1.2.2 through 1.2.7 Description: The issue is related to the DELETE endpoint located at packages/backend/src/api/v1/datasets, which is vulnerable to unauthorized dataset deletion due to missing authorization and...

PT-2024-34602 · Sourcecodester · Sourcecodester Electricity Consumption Monitoring Tool

Name of the Vulnerable Software and Affected Versions: SourceCodester Electricity Consumption Monitoring Tool version 1.0 Description: A critical issue has been identified, affecting the /endpoint/delete-bill.php file. The manipulation of the bill argument leads to SQL injection. This issue can b...

Electricity Consumption Monitoring Tool SQL注入漏洞

Electricity Consumption Monitoring Tool is an electricity consumption monitoring tool by rems individual developer. A SQL injection vulnerability exists in Electricity Consumption Monitoring Tool version 1.0, which originates from an unknown function in /endpoint/delete-bill.php that causes SQL...

DEBIAN-CVE-2024-35895

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any...

CVE-2024-35895

The CVE-2024-35895 vulnerability affects the Linux kernel, specifically the BPF sockmap/sockhash path. A deadlock could occur when map_delete_elem is invoked from a context where interrupts are disabled; the fix adds a hardirq-safety check to bail out if map_delete_elem runs in a non-hardirq-unsa...

CVE-2024-35895 bpf, sockmap: Prevent lock inversion deadlock in map delete elem

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any...

CVE-2024-35895 bpf, sockmap: Prevent lock inversion deadlock in map delete elem

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Prevent lock inversion deadlock in map delete elem syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Because BPF tracing programs can be invoked from any...

CVE-2024-28064

Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations with displayLoginChunkedImages and write operations with storeLoginChunkedImages...

CVE-2024-28064

Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated file read and delete operations with displayLoginChunkedImages and write operations with storeLoginChunkedImages...

CVE-2024-28064

Kiteworks Totemomail 7.x–8.2.1 is vulnerable to directory traversal via the /responsiveUI/EnvelopeOpenServlet endpoint using the messageId parameter, enabling unauthenticated read, delete, and write operations. Root cause involves directory traversal in the EnvelopeOpenServlet handling of message...

UBUNTU-CVE-2024-35806

In the Linux kernel, the following vulnerability has been resolved: soc: fsl: qbman: Always disable interrupts when taking cgrlock smpcallfunctionsingle disables IRQs when executing the callback. To prevent deadlocks, we must disable IRQs when taking cgrlock elsewhere. This is already done by...

Improper Access Control

mlflow is vulnerable to Improper Access Control. The vulnerability is due to improper validation of DELETE requests by users with EDIT permissions, allowing unauthorized deletions of artifacts...

GitLab 12.10 < 13.3.9 / 13.4 < 13.4.5 / 13.5 < 13.5.2 (CVE-2020-13359)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and oth...