The vulnerability of the microprogrammed software of the Surface Pro 3 touchscreen display, related to authentication errors, allows a intruder to circumvent existing security restrictions.

The vulnerability of the microprogrammed sensor display software in the Surface Pro 3 is related to authentication errors. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions...

Debian DSA-5138-1 : waitress - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5138 advisory. It was discovered that the Waitress WSGI server was susceptible to HTTP request smuggling in some scenarios when used behind a proxy. For the oldstable distribution...

Moodle Cross-site Scripting in assignment submission page

In Moodle 3.x, there is Cross-site Scripting in the assignment submission page...

GHSA-93GJ-RG98-H7MM Moodle XSS Vulnerability

In Moodle 3.x, XSS can occur via evidence of prior learning...

GHSA-54R2-R67G-FR9M Moodle User fullname disclosure on user preferences page

Moodle 3.x has user fullname disclosure on the user preferences page...

Moodle User fullname disclosure on user preferences page

Moodle 3.x has user fullname disclosure on the user preferences page...

Moodle sensitive information disclosure

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

bluez security update

5.56-3 + bluez-5.56-3 - Fixing 2027434 - Fixing CVE-2021-41229 5.56-2 + bluez-5.56-2 - Fixing 1968392 - Removing bccmd check from tests 5.56-1 + bluez-5.56-1 - Fixing 1965057 - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56...

Smarty PHP code injection

Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling fetch or display functions on custom resources that does not sanitize template name...

GHSA-332G-XH34-5C96 Moodle Privilege escalation in quiz web services

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

Moodle Privilege escalation in quiz web services

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

Moodle XSS Vulnerability

In Moodle 3.x, there is XSS via a calendar event name...

GHSA-595J-WPFG-23W4 Moodle XSS Vulnerability

In Moodle 3.x, there is XSS via a calendar event name...

GHSA-5VPR-V24W-MMJJ Drupal cross site scripting vulnerability

A jQuery cross site scripting vulnerability is present when making Ajax requests to untrusted domains. This vulnerability is mitigated by the fact that it requires contributed or custom modules in order to exploit. For Drupal 8, this vulnerability was already fixed in Drupal 8.4.0 in the Drupal...

Moodle Portfolio forum caller class allows a user to download any file

An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL...

Silverstripe Framework SQLi Vulnerability

All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject...

Moodle SSRF Vulnerability

Moodle 3.x has Server Side Request Forgery in the filepicker...

GHSA-3G56-2HH3-35PH SoSReport Predictable Tmp File Names

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date...

SoSReport Predictable Tmp File Names

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by sosreport-$hostname-$date.tar in /tmp/sosreport-$hostname-$date...

Moodle Cross-site Scripting

An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to...