987 matches found
PT-2023-30245 · Moodle +1 · Moodle +1
Name of the Vulnerable Software and Affected Versions: Moodle version 4.3 Description: The issue allows for reflected XSS in the /grade/report/grader/index.php endpoint when the searchvalue parameter is used, and the user is logged in as a teacher. According to the Moodle Security FAQ, teachers c...
CVE-2023-46858
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...
CVE-2023-46858
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...
GHSA-M425-MQ94-257G vulnerabilities
Vulnerabilities for packages: spark-operator, kubevela, scorecard, aactl, kubeflow, up, buildkitd, dgraph, terraform-provider-sendgrid, kubescape, k3d, src, cortex, slsa-verifier...
WordPress Mediabay Plugin <= 1.6 is vulnerable to Broken Access Control
Software Mediabay Type Plugin Vulnerable versions = 1.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-46612 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 01f288807115 Credits emad Required privilege Subscriber...
CVE-2023-39999
Exposure of Sensitive Information to an Unauthorized Actor in WordPress from 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.13, from 6.0 through 6.0.5, from 5.9 through 5.9.7, from 5.8 through 5.8.7, from 5.7 through 5.7.9, from 5.6 through 5.6.11, from 5.5 through 5.5.12, from 5.4...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: dex, pulumi, kaf, conftest, nodetaint, prometheus-adapter, bom, aactl, certificate-transparency, hugo, git-lfs, kubescape, src, pulumi-kubernetes-operator, cortex, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, kubewatch, rqlite, k3d, ko, nri-prometheus,...
CVE-2023-44487 vulnerabilities
Vulnerabilities for packages: dex, pulumi, kaf, conftest, nodetaint, prometheus-adapter, bom, aactl, certificate-transparency, hugo, git-lfs, kubescape, src, pulumi-kubernetes-operator, cortex, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, kubewatch, rqlite, k3d, ko, nri-prometheus,...
WordPress Mailrelay Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software Mailrelay Type Plugin Vulnerable versions = 2.1.1 Fixed in 2.1.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-45108 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 19213d6f5e3d Credits Mika Required privilege...
WordPress Checkfront Online Booking System Plugin <= 3.6 is vulnerable to Cross Site Request Forgery (CSRF)
Software Checkfront Online Booking System Type Plugin Vulnerable versions = 3.6 Fixed in 3.7 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44146 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4851b589bde2 Credits BuShiY...
CVE-2023-22644
A user can reverse engineer the JWT token JSON Web Token used in authentication for Manager and API access, forging a valid NeuVector Token to perform malicious activity in NeuVector. This can lead to an RCE...
Code injection
An Innsertion of Sensitive Information into Log File vulnerability in SUSE SUSE Manager Server Module 4.2 spacewalk-java, SUSE SUSE Manager Server Module 4.3 spacewalk-java causes sensitive information to be logged. This issue affects SUSE Manager Server Module 4.2: before 4.2.50-150300.3.66.5;...
WordPress Easy WP Cleaner Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)
Software Easy WP Cleaner Type Plugin Vulnerable versions = 1.9 Fixed in 2.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41697 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 515d5d148a8d Credits Mika Required privilege...
XWiki 4.3-milestone-2 < 14.10.5 Privilege Escalation Vulnerability (GHSA-5mf8-v43w-mfxp)
XWiki is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescripti...
CVE-2020-36138
An issue was discovered in decodeframe in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service DoS...
Design/Logic Flaw
An issue was discovered in decodeframe in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service DoS...
CVE-2020-36138
An issue was discovered in decodeframe in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service DoS...
CVE-2020-36138
An issue was discovered in decodeframe in libavcodec/tiff.c in FFmpeg version 4.3, allows remote attackers to cause a denial of service DoS...
HPESBGN04499 rev.2 - HPE Unified Correlation Analyzer, Multiple Vulnerabilities
Potential Security Impact: Local: Directory Traversal; Remote: Access Restriction Bypass, Authentication Bypass, Code Execution, Denial of Service DoS, Disclosure of Information, XML External Entity XXE, Input Validation SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified...