Open Automation Software OAS Platform 访问控制错误漏洞

Open Automation Software OAS Platform is an industrial Internet of Things IoT suite from Open Automation Software, Inc. Open Automation Software OAS Platform V16.00.0121 is vulnerable to an access control error that could be exploited by an attacker to make unauthenticated use of the REST API wit...

GHSA-2M72-M5CW-3G9H Missing permission check in Moodle

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

Missing permission check in Moodle

The web service responsible for fetching other users' enrolled courses did not validate that the requesting user had permission to view that information in each course in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

GHSA-5J25-5HJR-W7M2 Magento 2 Community Edition Information Leak

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP reques...

Magento 2 Community Edition Information Leak

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP reques...

GHSA-WW45-X87C-WGFF Moodle all messaging conversations could be viewed

A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations...

Moodle all messaging conversations could be viewed

A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations...

CVE-2020-1692

A flaw was found in moodle. Users' web service tokens could be exposed to other users enrolled in the same course, who have the ability to share HTML content. The highest threat from this vulnerability is to data confidentiality and integrity...

PT-2022-15664 · Tibco · Tibco Jasperreports Server +5

Name of the Vulnerable Software and Affected Versions: TIBCO JasperReports Server versions 8.0.1 and below TIBCO JasperReports Server - Community Edition versions 8.0.1 and below TIBCO JasperReports Server - Developer Edition versions 8.0.0 and below TIBCO JasperReports Server for AWS Marketplace...

GHSA-JF7G-5Q92-4HP2 Apache ODE Path Traversal vulnerability

The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was...

Apache ODE Path Traversal vulnerability

The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was...

Pimcore SQLi Vulnerability

Pimcore before 5.3.0 allows SQL Injection via the REST web service API...

GHSA-5W4H-XRR5-7273 Moodle Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the corecoursegetcategories web service to return hidden categories, which should be omitted when fetching course categories...

Moodle Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the corecoursegetcategories web service to return hidden categories, which should be omitted when fetching course categories...

Moodle creates a MoodleMobile web-service token with an infinite lifetime

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

GHSA-48RQ-VJ58-2MH6 Moodle creates a MoodleMobile web-service token with an infinite lifetime

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

Moodle cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the usergetuserdetails function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an externalformattext call in ...

GHSA-GMHR-6F43-7QPJ Moodle does not properly implement group-based access restrictions

The coreenrolgetenrolledusers web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant...

Moodle does not properly implement group-based access restrictions

The coreenrolgetenrolledusers web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant...

GHSA-F7QM-Q26P-6RR2 Moodle cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the usergetuserdetails function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an externalformattext call in ...