Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JMS configuration. An attacker with permissions to configure JMS for Apache CXF can achieve remote code execution by supplying malicious RMI or LDAP URLs in the configuration. Details...

Moodle 4.3.x < 4.3.12 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.18 or 4.3.x prior to 4.3.12 or 4.4.x prior to 4.4.8 or 4.5.x prior to 4.5.4. It is, therefore, affected by multiple vulnerabilities : - Additional checks were required to ensure users can on...

CVE-2024-20118

In mms, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09062392; Issue ID: MSV-1621...

CVE-2023-30920

In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30919

In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30922

In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30923

In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30921

In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2023-30924

In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2022-38698

In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed...

CVE-2022-44436

In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed...

CVE-2022-44434

In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed...

CVE-2022-39080

In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed...

CVE-2022-39117

In messaging service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...

CVE-2022-44438

In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed...

CVE-2022-44439

In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed...

CVE-2022-44435

In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed...

CVE-2022-44437

In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed...

CVE-2022-38697

In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed...

Incorrect Authorization

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Incorrect Authorization due to insufficient capability checks in the messaging web service. An attacker can view other users' names and online statuses by exploiting this flaw. Remediation Upgrade...