138 matches found
Malicious code in nodebb-plugin-sso-auto-login (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3ab1b77199e67562a75d535a0d6c88f5d8d4c76b8df6d226e9528b0e050006 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-634 Malicious code in nodebb-plugin-sso-auto-login (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3ab1b77199e67562a75d535a0d6c88f5d8d4c76b8df6d226e9528b0e050006 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The vulnerability of the implementation of automatic login for mobile devices in the virtual training environment Moodle allows a hacker to carry out a phishing attack and expose the protected information.
The vulnerability of the automatic login function in the Moodle virtual training system for mobile devices is related to improper cleaning of user data. Exploiting this vulnerability allows a malicious actor to carry out a phishing attack and disclose sensitive information through a specially...
Open Redirect
Moodle is vulnerable to open redirect. Lack of proper validation of auto login URL to be LOCAL URL allows an attacker to pass a URL to malicious website when clicked...
Moodle Open redirect risk in mobile auto-login feature
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this...
GHSA-243V-5PFF-QQFJ Moodle Open redirect risk in mobile auto-login feature
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this...
CVE-2022-35652
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this...
CVE-2022-35652
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this...
UBUNTU-CVE-2022-35652
An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link that leads to a trusted website, however, when clicked, it redirects the victims to arbitrary URL/domain. Successful exploitation of this...
CVE-2022-35652
CVE-2022-35652 describes an open redirect in Moodle due to improper sanitization of user-supplied data in the mobile auto-login feature. The root cause is lack of proper input sanitization, allowing a remote attacker to craft a link that points to a trusted site but redirects victims to an arbitr...
CVE-2020-27837
A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit...
PT-2022-4073 · Moodle +2 · Moodle +2
Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in the mobile auto-login feature. A remote attacker can create a link that leads to a trusted...
CVE-2020-26546
An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-26546
An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2020-26546
CVE-2020-26546 : The connected PT-2020-16450 entry documents a SQL injection issue in the RememberMe functionality of HelpDeskZ version 1.0.2. The root cause is that the RememberMe feature is prone to SQL injection, and this vulnerability affects a legacy, no-longer-supported release. The advisor...
CVE-2020-12834
eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...
Design/Logic Flaw
eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...
Authentication flaw
confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the autologin parameter...
Nagios XI Cross-Site Scripting Vulnerability (CNVD-2019-23522)
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in the Auto-Login administrator management page in Nagios XI...