CVE-2024-3474

CVE-2024-3474 concerns the WordPress plugin Wow Skype Buttons (versions before 4.0.4). The issue is a CSRF vulnerability in certain bulk actions that can let an authenticated, logged-in admin perform unauthorized operations, such as deleting buttons, via crafted requests. Public descriptions in R...

CVE-2024-20347

A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow the attacker to perform arbitrary actions on an affected device. This vulnerability is due to insufficient protections for the web UI of an affected system. An...

CVE-2024-31420

A NULL pointer dereference flaw was found in KubeVirt. This flaw allows an attacker who has access to a virtual machine guest on a node with DownwardMetrics enabled to cause a denial of service by issuing a high number of calls to vm-dump-metrics --virtio and then deleting the virtual machine...

CVE-2023-49982

Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a memory corruption in the core service when executing a command to delete a single event listener...

CVE-2024-23756

The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 5221, allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them...

PT-2024-8621

Name of the Vulnerable Software and Affected Versions OpenStack affected versions not specified Description A flaw was found in OpenStack. When a user tries to delete a non-existing access rule in its scope, it deletes other existing access rules which are not associated with any application...

WP Courses LMS < 3.2.4 - Missing Authorization

Description The plugin is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the /ajax/ajax-lesson-order.php file hooked via AJAX in all versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with...

CVE-2022-0775 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion

The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such as subscriber to delete arbitrary comment...

CVE-2023-49797

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if...

CVE-2023-28876

A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users...

How to delete catalogs created in the "Quick Deploy" interface

This article describes how to delete catalogs created in the "Quick Deploy" interface...

SUSE SLES15: libnss_slurm2_22_05 / libpmi0_22_05 / libslurm38 / perl-slurm_22_05 / etc (SUSE-SU-2023:4581-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2023:4581-1 advisory. - CVE-2023-41914: Fixed a filesystem handling race condition that could have led to an attacker taking control of an arbitrary file, or removing entire...

CVE-2023-41914

SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or deleting files...

Mattermost Server < 7.8.10 / 8.0.x < 8.0.2 / 8.1.0 Multiple Vulnerabilities (MMSA-2023-00222) (MMSA-2023-00224) (MMSA-2023-00230)

The version of Mattermost Server running on the remote host is prior to 7.8.10, 8.0.x prior to 8.0.2, or 8.1.0. It is, therefore, affected by multiple vulnerabilities: - Mattermost fails to properly check permissions when retrieving a post allowing for a System Role with the permission to manage...

CVE-2023-25980

CVE-2023-25980 concerns the WordPress plugin “Optimize Database after Deleting Revisions” (CAGE Web Design) with CSRF vulnerability in versions

WordPress Optimize Database after Deleting Revisions Plugin <= 5.0.110 is vulnerable to Broken Access Control

Software Optimize Database after Deleting Revisions Type Plugin Vulnerable versions = 5.0.110 Fixed in 5.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID fb16d5eb812a Credits WordFence...

CVE-2023-41938

A cross-site request forgery CSRF vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules...

CVE-2023-29288 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.6 and earlier, 2.4.5-p2 and earlier and 2.4.4-p3 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A privileged attacker could leverage this vulnerability to modify a minor functionality of another user...

git: arbitrary configuration injection when renaming or deleting a section from a configuration file

A vulnerability was found in Git. This security flaw occurs when renaming or deleting a section from a configuration file, where certain malicious configuration values may be misinterpreted as the beginning of a new configuration section. This flaw leads to arbitrary configuration injection...