GitHub: Git Reference Ambiguity in GitHub - Commit Smuggling, Account Takeover, and Remote Code Execution

A vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling due to an incorrect diff comparison in re-opened pull requests. This affected all versions of GitHub Enterprise Server and was fixed in newer releases...

Python < 3.6.13, 3.7.x < 3.7.10, 3.8.x < 3.8.8, 3.9.x < 3.9.2 Python Issue (bpo-42938) - Linux

Python is prone to a buffer overflow vulnerability in SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescripti...

CVE-2021-22886

CVE-2021-22886 affects Rocket.Chat prior to version 3.11, 3.10.5, 3.9.7, and 3.8.8. It enables persistent XSS via nested markdown tags that can inject JavaScript in messages, with impacts including arbitrary file read and RCE on the Rocket.Chat desktop app. Patches/updates have been released for ...

CVE-2021-20280

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

CVE-2021-20279

The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

UBUNTU-CVE-2021-20283

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

Moodle 安全漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17, which stems from a failure to validate that a requesting...

PT-2021-13873 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 3.10.2 Moodle versions prior to 3.9.5 Moodle versions prior to 3.8.8 Moodle versions prior to 3.5.17 Description: It was possible for some users without permission to view other users' full names via the online users...

PT-2021-13874 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: moodle versions prior to 3.10.2 moodle versions prior to 3.9.5 moodle versions prior to 3.8.8 moodle versions prior to 3.5.17 Description: When creating a user account, it was possible to verify the account without having access to the...

PT-2021-13871 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: moodle versions prior to 3.10.2 moodle versions prior to 3.9.5 moodle versions prior to 3.8.8 moodle versions prior to 3.5.17 Description: The ID number user profile field required additional sanitizing to prevent a stored XSS risk...

Python < 3.6.13, 3.7.x < 3.7.10, 3.8.x < 3.8.8, 3.9.x < 3.9.2 Web Cache Poisoning Vulnerability - Linux

Python is prone to a web cache poisoning vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python";...

WordPress Simple Download Monitor SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Simple Download Monito is used in one of the site download management plugin. A SQL injection vulnerability exists in Simple Download...

CVE-2020-5651

SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL...

Joomla! access control error vulnerability (CNVD-2020-25678)

Joomla! is the U.S. Open Source Matters team of a set of PHP and MySQL development using open source , cross-platform content management system CMS. An access control error vulnerability exists in Joomla! versions 3.8.8 through 3.9.16, which can be exploited by an attacker to make unauthorized...

Joomla! Core Arbitrary File Upload Vulnerability (CNVD-2018-15189)

Joomla! is an open source content management system CMS. The system provides RSS feeds , site search and other features . Joomla! Core is a Joomla! core. Core 3.8.8 before the version of the arbitrary file upload vulnerability exists. A remote attacker can exploit this vulnerability to upload...

Joomla! Core Information Disclosure Vulnerability

Joomla! is an open source content management system CMS. The system provides RSS feeds , site search and other features . Joomla! Core is a Joomla! core. An information disclosure vulnerability exists in Joomla! Core versions prior to 3.8.8, which stems from the program failing to perform...

Multiple Cross-Site Scripting Vulnerabilities in Joomla! Core

Joomla! is an open source content management system CMS. The system provides RSS feeds , site search and other features . Joomla! Core is a Joomla! core. Multiple cross-site scripting vulnerabilities exist in Joomla! Core versions prior to 3.8.8, which stem from the program failing to properly...

Joomla Multiple Vulnerabilities (20180507, 20180505, 20180504)

Joomla is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla"; ifdescription...

Code injection

An issue was discovered in Joomla! Core before 3.8.8. Depending on the server configuration, PHAR files might be handled as executable PHP scripts by the webserver...

CVE-2018-11328

An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances a redirect issued with a URI containing a username and password when the Location: header cannot be used, a lack of escaping the user-info component of the URI could result in an XSS vulnerability...