Moodle CMS 3.6.x <= 3.6.2 Authentication Bypass Vulnerability

Moodle CMS is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...

The vulnerability of the Capability Licensing Service, related to lack of access control, allows a violator to increase their privileges.

The vulnerability of the Capability Licensing Service is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to increase their privileges...

Ignored Context Locking

Moodle is vulnerable to ignored context locking. The functions getwithcapabilityjoin and getusersbycapability do not take the context locking feature into account when considering user capability...

The existence of arbitrary file deletion vulnerability dedecms

DedeCMS Dream Weaving Content Management System is China's Zhuozhuo Network Desdev Technology Co., Ltd. of a set of open-source set of content publishing, editing, management and retrieval is equal to one of the PHP Web site content management system CMS. dedecms there are arbitrary file deletion...

CVE-2019-3808

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use b...

Design/Logic Flaw

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use b...

CVE-2019-3808

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use b...

CVE-2019-3808

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use b...

OPENSUSE-SU-2019:0243-1 Security update for dovecot23

This update for dovecot23 fixes the following issues: dovecot was updated to 2.3.3 release, bringing lots of bugfixes bsc1124356. Also the following security issue was fixed: - CVE-2019-3814: A vulnerability in Dovecot related to SSL client certificate authentication was fixed bsc1123022 The...

SUSE-SU-2019:0683-1 Security update for the Linux Kernel (Live Patch 22 for SLE 12 SP2)

This update for the Linux Kernel 4.4.121-9280 fixes several issues. The following security issues were fixed: - CVE-2019-9213: Expanddownwards in mm/mmap.c lacked a check for the mmap minimum address, which made it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP...

Intel Capability Licensing Service Elevation of Privilege Vulnerability

Intel Capability Licensing Service is an Intel Capability Licensing Service interface from Intel Corporation. A security vulnerability exists in Intel Capability Licensing Service versions prior to 1.50.638.1, which arises from the program's failure to enforce adequate access controls. A local...

CVE-2018-12200

Insufficient access control in IntelR Capability Licensing Service before version 1.50.638.1 may allow an unprivileged user to potentially escalate privileges via local access...

Improper access control

Insufficient access control in IntelR Capability Licensing Service before version 1.50.638.1 may allow an unprivileged user to potentially escalate privileges via local access...

CVE-2018-12200

CVE-2018-12200 affects Intel Capability Licensing Service with insufficient access control in versions before 1.50.638.1, enabling an unprivileged user to escalate privileges via local access. Connected sources (Intel/Lenovo/HP advisories) corroborate a family of related Intel components (CSME, S...

CVE-2018-12200

Insufficient access control in IntelR Capability Licensing Service before version 1.50.638.1 may allow an unprivileged user to potentially escalate privileges via local access...

Linux < 4.20.14 - Virtual Address 0 is Mappable via Privileged write() to /proc/*/mem

By following the codepath that Andrea Arcangeli pointed out in his mails regarding the last bug I reported, I noticed that it is possible for userspace on a normal distro to map virtual address 0, which on an X86 system without SMAP enables the exploitation of kernel NULL pointer dereferences. Th...

Null pointer dereference

In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task...

CVE-2019-9213

In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task...

CVE-2019-9213

In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task...

CVE-2019-9213

In the Linux kernel before 4.20.14, expanddownwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on non-SMAP platforms. This is related to a capability check for the wrong task...