13367 matches found
SUSE CVE-2024-26769
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid deadlock on delete association path When deleting an association the shutdown path is deadlocking because we try to flush the nvmetwq nested. Avoid this by deadlock by deferring the put work into its own work item...
Multiple Page Generator Plugin – MPG < 3.4.1 - Cross-Site Request Forgery
Description The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4.0. This is due to missing or incorrect nonce validation on the deleteproject action. This makes it possible for unauthenticated attackers to...
ROS-20240411-08
The Jenkins Automation Server vulnerability involves the creation of temporary files with insecure permissions. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to read, modify, or delete files A vulnerability in the args4j library of the Jenkins Git server...
GHSA-99W2-67H8-5948 Aim Cross-Site Request Forgery vulnerability allows user to delete runs and perform other operations
aimhubio/aim is vulnerable to Cross-Site Request Forgery CSRF, allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboar...
CVE-2024-1625
An Insecure Direct Object Reference IDOR vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails t...
CVE-2024-1625
An Insecure Direct Object Reference IDOR vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails t...
CVE-2024-1625
CVE-2024-1625 affects lunary-ai/lunary, version 0.3.0, with an Insecure Direct Object Reference (IDOR) in the project deletion endpoint. The root cause is insufficient authorization checks that fail to verify if the provided project ID belongs to the requesting user’s organization, enabling delet...
CVE-2024-3536
A vulnerability has been found in Campcodes Church Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/deletelog.php. The manipulation of the argument selector leads to sql injection. The attack can be initiated remotely. The exploit has be...
Aim 跨站请求伪造漏洞
Aim is an easy-to-use and high-performance open source experiment tracker from the United States. Aim suffers from a cross-site request forgery vulnerability. An attacker could use this vulnerability to perform actions such as deleting runs, updating data, and stealing data such as log records an...
PT-2024-26459 · Unknown · Campcodes Church Management System
Name of the Vulnerable Software and Affected Versions: Campcodes Church Management System version 1.0 Description: A critical issue has been found in the system, affecting the /admin/delete log.php file. The manipulation of the selector argument leads to SQL injection. This issue can be exploited...
lunary 安全漏洞
Lunary is a production toolkit for LLM open sourced by lunary. A security vulnerability exists in lunary version 0.3.0, which stems from insufficient authorization checking in the project's delete endpoint...
Church Management System SQL注入漏洞
Church Management System is a church management system. A SQL injection vulnerability exists in version 1.0 of Church Management System, which originates from a SQL injection vulnerability in the selector parameter of the /admin/deletelog.php file...
The vulnerability of the expr_delete_term() function in the YASM assembler allows a hacker to trigger a service failure.
The vulnerability of the exprdeleteterm function in the YASM assembler is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a perpetrator to cause a service failure...
CVE-2024-31978
A vulnerability has been identified in SINEC NMS All versions V2.0 SP2. Affected devices allow authenticated users to export monitoring data. The corresponding API endpoint is susceptible to path traversal and could allow an authenticated attacker to download files from the file system. Under...
PT-2024-18361 · WordPress · Autowriter
Name of the Vulnerable Software and Affected Versions: AutoWriter plugin for WordPress versions up to, and including, 3.3 Description: The issue allows authenticated attackers with subscriber access or higher to access, modify, or delete posts due to a missing capability check on functions hooked...
WordPress Plugin Advanced Classifieds & Directory Pro 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
PT-2024-3046
Name of the Vulnerable Software and Affected Versions: SINEC NMS versions prior to V2.0 SP2 Description: A vulnerability has been identified that allows authenticated users to export monitoring data. The corresponding API endpoint is susceptible to path traversal, which could allow an authenticat...
CVE-2024-27630
Insecure Direct Object Reference IDOR in GNU Savane v.3.12 and before allows a remote attacker to delete arbitrary files via crafted input to the trackersdatadeletefile function...