Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from the need to perform additional checks to ensure that users only ha...

CVE-2024-52585

Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing...

CVE-2024-52585 Autolab has HTML Injection Vulnerability

Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in version 3.0.1 that can affect instructors and CAs on the grade submissions page. The issue is patched in version 3.0.2. One may apply the patch manually by editing...

CVE-2024-52585

Autolab CVE-2024-52585 affects Autolab 3.0.1 with an HTML injection vulnerability on the grade submissions page that can impact instructors and CAs. The issue is mitigated by upgrading to 3.0.2 or applying the patch manually: edit line 589 in gradesheet.js.erb to take in feedback as text rather t...

CVE-2024-52584 Autolab has vulnerable submission endpoints

Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAs can view or edit the grade for any submission ID, even if they are not a CA for the class that has the submission. The endpoints only check that the CAs hav...

CVE-2024-52584

CVE-2024-52584 – Autolab : Affected software is Autolab (course management service). In version 3.0.1, the authorization check for grade-submission endpoints is scoped to the CA’s class, not the specific submission’s class, allowing CAs to view or edit grades for any submission ID regardless of t...

Autolab 跨站脚本漏洞

Autolab is an open source course management service from Autolab. It supports automatically graded programming assignments. A cross-site scripting vulnerability exists in Autolab version 3.0.1, which stems from the presence of an HTML injection vulnerability that could affect instructors and CAs ...

PT-2024-35382 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab version 3.0.1 Description: The issue concerns an HTML injection vulnerability that can affect instructors and CAs on the grade submissions page. This vulnerability is patched in version 3.0.2. Recommendations: For Autolab version 3.0....

CVE-2024-51658

Cross-Site Request Forgery CSRF vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through = 1.3...

CVE-2024-51658 WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through = 1.3...

CVE-2024-51658 WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Henrik Hoff WP Course Manager wp-course-manager allows Stored XSS.This issue affects WP Course Manager: from n/a through = 1.3...

CVE-2024-51658

CVE-2024-51658 describes a Cross-Site Request Forgery (CSRF) that enables Stored XSS in the WordPress plugin WP Course Manager for versions up to 1.3. The vulnerability impact is described as stored XSS via CSRF, affecting the WP Course Manager plugin in the listed range. The provided documents d...

WordPress plugin WP Course Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2024-51593

CVE-2024-51593 is a stored XSS vulnerability in the WordPress Курс валют UAH plugin, involving improper input neutralization during page generation. Affected versions are n/a through 2.0. The connected sources (Patchstack and CVE records) confirm that the issue is a stored XSS in that plugin and ...

WordPress WP Course Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin WP Course Manager versions = 1.3...

CVE-2024-10612

A vulnerability was found in ESAFENET CDG 5. It has been classified as critical. Affected is the function removeHookInvalidCourse of the file /com/esafenet/servlet/system/HookInvalidCourseService.java. The manipulation of the argument id leads to sql injection. It is possible to launch the attack...

WordPress WP Course Manager Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Course Manager Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51658 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID fb5da93f1648 Credits SOPROBRO Required...

EsafeNet CDG SQL注入漏洞

EsafeNet CDG is a document security management system from EsafeNet. A SQL injection vulnerability exists in EsafeNet CDG v5, which originates from the parameter id of the file /com/esafenet/servlet/system/HookInvalidCourseService.java that can lead to SQL injection...

PT-2024-16392 · Safenet · Esafenet Cdg 5

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG 5 Description: A critical vulnerability was found in ESAFENET CDG 5, affecting the function delFile/delDifferCourseList of the file /com/esafenet/servlet/ajax/PublicDocInfoAjax.java. This vulnerability leads to SQL injection and...

CVE-2024-10000 Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Stored Cross-Site Scripting via Ask a Question Functionality

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it...