330 matches found
CVE-2023-37244 Privilege escalation in N-Able's AutomationManagerAgent
The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into...
CVE-2023-37244
The CVE-2023-37244 entry concerns AutomationManager.AgentService.exe and describes a TOCTOU race condition that lets standard users create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp. This could enable an attacker to manipulate the process into performing arbitra...
PT-2024-24118 · Mintplex +1 · Anything-Llm +1
Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: A Server-Side Request Forgery SSRF vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin...
Oracle E-Business Suite 的 Oracle Installed Base 安全漏洞
Oracle E-Business Suite and Oracle Installed Base are both products of Oracle Corporation.Oracle E-Business Suite is a fully integrated suite of global business management software. The software provides customer relationship management, service management, financial management and other...
BIT-GITLAB-2020-13341
An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions...
BIT-GITLAB-2022-0477
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries...
BIT-MOODLE-2021-36397
In Moodle, insufficient capability checks meant message deletions were not limited to the current user...
PT-2024-18443 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.8 Mattermost versions 9.4.x through 9.4.1 Description: A race condition allows an authenticated attacker to gain unauthorized access to individual posts' contents via carefully timed post creation while...
Elementor < 3.19.1 - Authenticated(Contributor+) Arbitrary File Deletion and PHAR Deserialization
Description The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to arbitrary file deletions and PHAR deserialization in version up to, and including 3.19.0. This is due to the plugin not providing sufficient path validation on the 'tmpname' parameter...
CVE-2024-23756
The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 5221, allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them...
Oracle Audit Vault and Database Firewall Security Vulnerabilities
Oracle Audit Vault and Database Firewall is a database security solution from Oracle Corporation. A security vulnerability exists in Oracle Audit Vault and Database Firewall versions 20.1 through 20.9. An attacker could exploit the vulnerability to perform unauthorized updates, insertions, or...
15,000 Go Module Repositories on GitHub Vulnerable to Repojacking Attack
New research has found that over 15,000 Go module repositories on GitHub are vulnerable to an attack called repojacking. "More than 9,000 repositories are vulnerable to repojacking due to GitHub username changes," Jacob Baines, chief technology officer at VulnCheck, said in a report shared with T...
CrushFTP Security Vulnerability
CrushFTP is a file transfer server. A security vulnerability exists in CrushFTP versions prior to 10.5.1 that stems from improper control of object properties, which can be exploited by an attacker to gain partial control over Java properties and allow arbitrary file reads and deletion of...
LOYTEC LINX-212 Access Control Error Vulnerability
The LOYTEC LINX-212 is a building controller from LOYTEC. An access control error vulnerability exists in the LOYTEC LINX-212 6.2.4 firmware version, which stems from a lack of authentication on the Web user interface, and can be exploited by an attacker to edit or delete current Web items, chang...
PT-2023-27345 · WordPress · Radio Player
Name of the Vulnerable Software and Affected Versions: Radio Player plugin for WordPress versions up to, and including, 2.0.73 Description: The issue is related to a missing capability check on the delete player function, allowing unauthenticated attackers to modify data by deleting player...
CLSA-2023-1688072342 Fix of 5 CVEs
CVE-2023-32233 // CVE-url: https://ubuntu.com/security/CVE-2023-32233 - netfilter: nftables: add nftsetisanonymous helper - netfilter: nftables: split set destruction in deactivate and destroy phase - netfilter: nftables: unbind set in rule from commit path - netfilter: nftables: fix set...
Improper Access Control
admidio/admidio is vulnerable to Improper Access Control. The vulnerability exists in the delete function of messages.php which allows an attacker to perform unauthorized message deletions...
PT-2023-17235 · Unknown · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: When running in a High Availability configuration, Mattermost fails to sanitize some of the user updated and post deleted events broadcast to all users, leading to disclosure of sensitiv...
