EUVD-2020-0256

Malware in sbrugna...

CVE-2025-42991

SAP S/4HANA Bank Account Application does not perform necessary authorization checks. This allows an authenticated 'approver' user to delete attachment from bank account application of other user, leading to a low impact on integrity, with no impact on the confidentiality of the data or the...

CVE-2024-10366

An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...

Cross site scripting

The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXELDEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

Atlassian Confluence < 7.13.17 Read Only User Attachment Uploads Service

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior to 7.13.17, 7.14.0 prior to 7.19.9 or 7.20 prior to 8.2.2. It is, therefore, affected by a flaw which permits remote attackers with read only permissions to a page to upload...

FreeBSD : mongodb -- Attach IDs to users (880bca8f-e201-11e9-8af7-08002720423d)

Mitch Wasson of Cisco's Advanced Malware Protection Group reports : After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's session to persist and become conflated with new accounts, if those accounts reuse the names of deleted ones...

Remote File Attachment Theft via comm.lycos.com,angelfire.com, eudoramail.com

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Date Published: November 28, 2000 Title: Remote File Attachment Theft via comm.lycos.com,angelfire.com, eudoramail.com Class: Access Validation Error Remotely Exploitable: Yes Vulnerability Description: WebMail possibly WhoWhere.com software as...