3178 matches found
Session Hijack
Moodle is vulnerable to session hijacking. The web service tokens in MoodleMobile do not expire, this allows attackers to brute-force usable session tokens...
Cross-site Scripting (XSS)
Moodle is vulnerable to cross-site scripting XSS attacks. These attacks can be performed if a web service with the file upload function is available. Attackers can perform XSS attacks through the upload of a profile picture...
Information Disclosure
Moodle is vulnerable to information disclosure. A malicious user can pass a web-service request to the application to get sensitive information about calendar events...
Force-Password-Change Bypass
Moodle is vulnerable to the bypass of the force-password-change requirement. Even when a password is forced to be changed on login, its possible for the temporary password to be used to create web service tokens, thus extending the life of the temporary password...
Cross-site Scripting (XSS)
Moodle is vulnerable to cross-site scripting XSS attacks. Attackers can use the usergetuserdetails function to inject arbitrary web script due to the absence of a call to externalformattext in a web service...
Information Disclosure
Moodle is vulnerable to information disclosure. Authenticated attackers can use the coreenrolgetenrolledusers web service to obtain sensitive information about course-participants...
Hammock AssetView for MacOS Path Traversal Vulnerability
Hammock AssetView for MacOS is a MacOS-based IT asset and network topology management system from Hammock Japan. The system manages various IT asset information and network topology information, and collects inventory information at regular intervals. A directory traversal vulnerability exists in...
Hammock AssetView for MacOS SQL Injection Vulnerability
Hammock AssetView for MacOS is a MacOS-based IT asset and network topology management system from Hammock Japan. The system manages various IT asset information and network topology information, and collects inventory information at regular intervals. A SQL injection vulnerability exists in Hammo...
gSOAP vulnerable to stack-based buffer overflow
Overview gSOAP library provided by Genivia contains a stack-based buffer overflowCWE-121. Processing a crafted SOAP message sent by a remote attacker may result in code execution. Impact Processing a crafted SOAP message sent by a remote attacker may result in code execution. Solution Update to t...
Oracle JRockit R28.3.14 Multiple Vulnerabilities (July 2017 CPU)
The version of Oracle JRockit installed on the remote Windows host is R28.3.14. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists in the 2D component that allows an unauthenticated, remote attacker to cause a denial of service condition. CVE-2017-10053 - Multip...
UBUNTU-CVE-2017-10243
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JAX-WS. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with...
CVE-2017-10118
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: JCE. Supported versions that are affected are Java SE: 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network acces...
UBUNTU-CVE-2017-10108
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: Serialization. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker...
CVE-2017-10053
Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE subcomponent: 2D. Supported versions that are affected are Java SE: 6u151, 7u141 and 8u131; Java SE Embedded: 8u131; JRockit: R28.3.14. Easily exploitable vulnerability allows unauthenticated attacker with network...
CVE-2017-8011
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...
Default credentials
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...
CVE-2017-8011
EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, EMC M&R for SAS Solution Packs EMC ViPR SRM prior to 4.1, EMC Storage M&R prior to 4.1, EMC VNX M&R all versions, EMC M&R Watch4Net for SAS Solution Packs all versions contain undocumented accounts with default passwords for Webservice Gateway and RMI J...
CVE-2017-2240
Directory traversal vulnerability in AssetView for MacOS Ver.9.2.0 and earlier versions allows remote attackers to read arbitrary files via "File Transfer Web Service"...