PT-2022-20959 · Unknown · Newsletter Module

Name of the Vulnerable Software and Affected Versions: Newsletter Module versions 3.x Description: The issue is related to a SQL injection vulnerability. It can be exploited via the zemez newsletter email parameter at the "/index.php" API endpoint. Recommendations: For Newsletter Module version...

TrelloC2 - Simple C2 Over The Trello API

Simple C2 over Trello's API Proof-of-Concept By: Fabrizio Siciliano @0rbz Update 12/30/2019 Removed hardcoded API key and Token, use input instead. Requirements Python 3.x Setup 1. Create a Trello account: https://trello.com/signup 2. Once logged in, get your API key: https://trello.com/app-key 3...

StackStorm st2 Infinite Loop Condition

StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data from an action or rule name...

SilverStripe Folders migrated from 3.x may be unsafe to upload to

In SilverStripe through 4.5, files uploaded via Forms to folders migrated from Silverstripe CMS 3.x may be put to the default "/Uploads" folder instead. This affects installations which allowed upload folder protection via the optional silverstripe/secureassets module under 3.x. This module is...

GHSA-MWH9-GR45-XVV4 Mule modules contain Directory Traversal

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway all versions released before August 1, 2019 allow remote attackers to read files accessible to the Mule process...

Mule modules contain Directory Traversal

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway all versions released before August 1, 2019 allow remote attackers to read files accessible to the Mule process...

Moodle Cross-site Scripting in assignment submission page

In Moodle 3.x, there is Cross-site Scripting in the assignment submission page...

GHSA-93GJ-RG98-H7MM Moodle XSS Vulnerability

In Moodle 3.x, XSS can occur via evidence of prior learning...

GHSA-54R2-R67G-FR9M Moodle User fullname disclosure on user preferences page

Moodle 3.x has user fullname disclosure on the user preferences page...

Moodle User fullname disclosure on user preferences page

Moodle 3.x has user fullname disclosure on the user preferences page...

Moodle sensitive information disclosure

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

GHSA-332G-XH34-5C96 Moodle Privilege escalation in quiz web services

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

Moodle Privilege escalation in quiz web services

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

GHSA-595J-WPFG-23W4 Moodle XSS Vulnerability

In Moodle 3.x, there is XSS via a calendar event name...

Moodle XSS Vulnerability

In Moodle 3.x, there is XSS via a calendar event name...

Moodle Portfolio forum caller class allows a user to download any file

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...

Moodle SSRF Vulnerability

Moodle 3.x has Server Side Request Forgery in the filepicker...

GHSA-3G56-2HH3-35PH SoSReport Predictable Tmp File Names

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date...

SoSReport Predictable Tmp File Names

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date...

Moodle Cross-site Scripting

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...