CVE-2021-40692

CVE-2021-40692 (Moodle) is described in connected sources as an insufficient capability check that allows teachers to download users outside of their courses. The OSV/NVD entries confirm the vulnerability is an access-control flaw enabling cross‑course user data access. Exploitation details or pa...

CVE-2021-40692

Insufficient capability checks made it possible for teachers to download users outside of their courses...

PT-2022-15054 · Unknown · Wasmcloud Host Runtime

Name of the Vulnerable Software and Affected Versions: wasmCloud Host Runtime versions prior to 0.52.2 Description: The issue affects the security model of actors in the wasmCloud Host Runtime, allowing them to bypass capability authorization. Normally, actors are required to declare their...

CVE-2021-24842

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1 list private post titles of other users and 2 change the posted date of other users' posts...

CVE-2021-24842 Bulk Datetime Change < 1.12 - Missing Authorisation

The Bulk Datetime Change WordPress plugin before 1.12 does not enforce capability checks which allows users with Contributor roles to 1 list private post titles of other users and 2 change the posted date of other users' posts...

CVE-2021-24842

The CVE-2021-24842 entry concerns the WordPress Bulk Datetime Change plugin (versions before 1.12). The vulnerability arises from missing capability checks, enabling users with Contributor roles to: 1) list private post titles of other users, and 2) change the posted date of other users’ posts. I...

PT-2021-16324 · WordPress · Bulk Datetime Change

Name of the Vulnerable Software and Affected Versions: Bulk Datetime Change WordPress plugin versions prior to 1.12 Description: The issue allows users with Contributor roles to list private post titles of other users and change the posted date of other users' posts due to a lack of capability...

CVE-2021-24703

The Download Plugin WordPress plugin before 1.6.1 does not have capability and CSRF checks in the dpwappluginactivate AJAX action, allowing any authenticated users, such as subscribers, to activate plugins that are already installed...

CVE-2021-43560

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...

CVE-2021-43560

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...

Design/Logic Flaw

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...

CVE-2021-43560

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...

CVE-2021-43560

CVE-2021-43560 (Moodle) : A flaw in Moodle versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions arises from insufficient capability checks . This weakness allows an attacker to potentially fetch other users’ calendar action events due to improper access control ...

CVE-2021-43560

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. Insufficient capability checks made it possible to fetch other users' calendar action events...

PT-2022-11301 · Alt Linux · Alt Linux

Name of the Vulnerable Software and Affected Versions: ALT Linux affected versions not specified Description: The issue is related to insufficient capability checks, allowing teachers to download users outside of their courses. This suggests a problem with access control or permissions within the...

CVE-2021-24853

The QR Redirector WordPress plugin before 1.6 does not have capability and CSRF checks when saving bulk QR Redirector settings via the qrsavebulk AJAX action, which could allow any authenticated user, such as subscriber to change the redirect response status code of arbitrary QR Redirects...

CVE-2021-24816

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own...

CVE-2021-24816

The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenixmediarename AJAX action, which could allow users with Author roles to rename any uploaded media files, including ones they do not own...

CVE-2021-24783

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts...

CVE-2021-24783

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts...