CVE-2021-24504: Improper Neutralization of Input During Web Page Generation

The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any use...

CVE-2021-24455: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution WordPress plugin before 1.9.2 did not escape the Summary field of Announcements when outputting it in an attribute, which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered...

Privilege escalation

Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\studentavatar.php...

CVE-2021-25200: Unrestricted Upload of File with Dangerous Type

Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code, via the file upload to \lms\studentavatar.php...

Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not escape the Summary field of Announcements when outputting it in an attribute, which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege...

Tutor LMS < 1.9.2 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin did not escape the Summary field of Announcements when outputting it in an attribute, which can be created by users as low as Tutor Instructor. This lead to a Stored Cross-Site Scripting issue, which is triggered when viewing the Announcements list, and could result in privilege...

DRUPAL-CONTRIB-2021-018

This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very flexible way the differents steps of a training in Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules e.g Security Kit to add them, leaving it...

Opigno group manager - Less critical - UI redressing (clickjacking) - SA-CONTRIB-2021-019

This project is related to Opigno LMS distribution. It implements the group manager in the Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules e.g Security Kit to add them, leaving it vulnerable to Clickjacking...

Opigno Learning path - Less critical - UI redressing (clickjacking) - SA-CONTRIB-2021-018

This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very flexible way the differents steps of a training in Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules e.g Security Kit to add them, leaving it...

PT-2021-31122

This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very flexible way the differents steps of a training in Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules e.g Security Kit to add them, leaving it...

PT-2021-31123

This project is related to Opigno LMS distribution. It implements the group manager in the Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules e.g Security Kit to add them, leaving it vulnerable to Clickjacking...

CVE-2020-8704

Race condition in a subsystem in the IntelR LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2020-8704

Race condition in a subsystem in the IntelR LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access...

Race condition

Race condition in a subsystem in the IntelR LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2020-8704

Race condition in a subsystem in the IntelR LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2020-8704

Race condition in a subsystem in the IntelR LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access...

CVE-2020-8704

CVE-2020-8704 affects Intel LMS (Local Manageability Service) with a race condition in the LMS subsystem prior to firmware v2039.1.0.0, enabling potential local privilege escalation. Mitigation per connected sources is to update to the latest firmware/software provided by OEM (Intel advisory INTE...

PT-2021-12812

Name of the Vulnerable Software and Affected Versions: IntelR LMS versions prior to 2039.1.0.0 Description: A race condition in a subsystem may allow a privileged user to potentially enable escalation of privilege via local access. Recommendations: For versions prior to 2039.1.0.0, update to...

CVE-2020-8704: Concurrent Execution using Shared Resource with Improper Synchronization

Race condition in a subsystem in the IntelR LMS versions before 2039.1.0.0 may allow a privileged user to potentially enable escalation of privilege via local access...

2021.1 IPU - Intel® CSME, SPS and LMS Security Updates

Intel has informed HP of potential security vulnerabilities in the Intel® Converged Security and Manageability Engine CSME, Server Platform Services SPS, and Intel® Local Manageability Service Intel® LMS which may allow escalation of privilege or information disclosure. Intel is releasing firmwar...