CVE-2016-5013

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

CVE-2016-5013

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

CVE-2016-5013

CVE-2016-5013 affects Moodle 2.x and 3.x, where text injection can occur in email headers, potentially enabling outbound spam. The available sources describe the affected software and the vulnerability class but do not provide exploitable vectors, affected versions beyond Moodle 2.x/3.x, or concr...

CVE-2016-5013

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

CVE-2016-5013: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam...

PT-2017-8649

Name of the Vulnerable Software and Affected Versions Moodle versions 2.x through 3.x Description The issue allows text injection in email headers, which could potentially lead to outbound spam. Recommendations For Moodle versions 2.x through 3.x, update to a version where this issue is fixed to...

CVE-2016-4048: Undefined Security Weakness

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev11. Custom messages can be shown at the login screen to notify external users about issues with sharing links. This mechanism can be abused to inject arbitrary text messages. Users may get tricked to follow instructions injected...

PT-2016-5820

Name of the Vulnerable Software and Affected Versions Open-Xchange OX App Suite versions prior to 7.8.1-rev11 Description An issue in the login screen notification mechanism for external users allows the injection of arbitrary text messages. This can be exploited for social engineering attacks,...

Urban Dictionary: Text injection on Auth problem at urbandictionary.com

A text injection bug was found and fixed. Simple text injection over Logout IDOR at Urban Dictionary :...

LocalTapiola: Error Page Content Spoofing or Text Injection (viestinta.lahitapiola.fi)

Hi team! I want to report a context spoofing or text injection at the new scope added viestinta.lahitapiola.fi Vulnerability Description: The new scope allows users to inject any content on the 404 not found webpage Vulnerable Location:...

Yelp: Error Page Text Injection

Hello Yelp team, Description : An attacker is able to inject his own text into error page and can fool the victim to visit his own malicious site. Please take a look at attached document, it contains POC as well as attack scenario about how the attacker can exploit this vulnerability and...

Udemy: Content Spoofing in udemy

Scenerio An attacker can include any arbitrary text using specially crafted udemy url. Reporting this but not sure if this is in scope text injection not marked in exclusion list Kindly mark it as informative in case if it is out of scope Issue seems to be because of sourcepage=clp param. If this...

Khan Academy: The web app's forgot password page is vulnerable to text injection/content spoofing

An attacker will exploit this by chaining it with CSRF there is not protection against CSRF for that page as scenario can only be created by a POST request. The attacker will target innocent users by doing this and some of them would fall in trap by calling the number or by sending the email. Mor...

FreeBSD : moodle -- multiple vulnerabilities (3ddcb42b-5b78-11e6-b334-002590263bf5)

Marina Glancy reports : - MSA-16-0019: Glossary search displays entries without checking user permissions to view them - MSA-16-0020: Text injection in email headers - MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course %NASLMINLEVE...

Phabricator: Error page Text Injection.

AS we can see in report an user or attacker is able to inject his text into error page and can trap to user to visit other site by adding following link /test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.malicious.com%20so%20go%20to%20the%20new%20one%20since%20this%20one A...

moodle -- multiple vulnerabilities

Marina Glancy reports: MSA-16-0019: Glossary search displays entries without checking user permissions to view them MSA-16-0020: Text injection in email headers MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course...

Nextcloud: Content Spoofing/Text Injection - docs.nextcloud.org

Issue: ====== Hey, I've found content spoofing also known as "Text Injection" in your sub-domain docs.nextcloud.org URL: ------- Here is the malicious URL: https://docs.nextcloud.org/.htacessCONTENT%20SPOOFING%20BY%20AHSAN Fix: Use custom 403 error page which doesn't contain user's text! I hope...

SecNews: Text injection on error page.

An user or attacker is able to inject his text into error page and can trap to user to visit malicious sites. Even if the XSS or error custom based 404 pages error injecting is not on the scope of our program,our committee decided to disclose it publicly...

Veris: Text injection can be used in phishing 404 page and should not include attacker text

Hello i want to report a text injection and a missconfiguration of the 404 page which can be used in phishing the bug exists at : http://veris.in/test/%2f../It%20has%20been%20changed%20by%20a%20new%20one%20https://www.crowdcurity.com%20so%20go%20to%20the%20new%20one%20since%20this%20one As you ca...

LocalTapiola: Content Spoofing or Text Injection (404 error page injection on yrityspalvelu)

Vulnerability Description: Application allows users to inject any content on the 404 not found webpage Vulnerable Location: https://yrityspalvelu.tapiola.fi/a1/has%20been%20changed%20by%20a%20new%20one%20https://www.attacker.com%20so%20go%20to%20the%20new%20one%20since%20this%20one Fix : just use...