GHSA-J5XF-GV89-G422 Moodle Cross-site Scripting vulnerability

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

CVE-2023-5544

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

CVE-2023-5544

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

Cross site scripting

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

CVE-2023-5544

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

UBUNTU-CVE-2023-5544

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

CVE-2023-5544 Moodle: stored xss and potential idor risk in wiki comments

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

CVE-2023-5544

CVE-2023-5544 relates to a stored XSS and potential IDOR risk in Moodle Wiki comments due to insufficient sanitization and access restrictions. Connected sources (OSV/GHSA advisories and Nessus notes) corroborate a Wiki comments stored XSS/IDOR issue, with no explicit affected versions or patch d...

CVE-2023-5544 Moodle: stored xss and potential idor risk in wiki comments

Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...

PT-2023-8910 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to insufficient sanitizing of Wiki comments, which poses a stored XSS risk and a potential IDOR risk. This could allow a remote attacker to perform cross-site scripting...

CVE-2023-46244

CVE-2023-46244 relates to a privilege-escalation in XWiki Platform where a user with only script permissions could cause velocity content to execute with the right of another document author, potentially returning the title as the unmodified document but instead exposing the attacker to the prote...

Atlassian Releases Urgent Confluence Patches Amid State-Backed Threats

By Deeba Ahmed Atlassian Confluence is a popular collaborative wiki system enterprises use to organize/share work. This is a post from HackRead.com Read the original post: Atlassian Releases Urgent Confluence Patches Amid State-Backed Threats...

CVE-2023-37909 Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 5.1-rc-1 and prior to versions 14.10.8 and 15.3-rc-1, any user who can edit their own user profile can execute arbitrary script macros including Groovy and Python macros th...

Moodle < 3.9.24, 3.11.x < 3.11.17, 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

Information Disclosure

mantisbt/mantisbt is vulnerable to Information Disclosure. The vulnerability is due to insufficient access-level checks on the Wiki redirection page which allows an attacker to reveal private Projects' names by accessing the wiki.php page...

MantisBT may disclose project names to unauthorized users

Impact Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. Patches The vulnerability has been fixed in MantisBT version 2.25.8...

GHSA-V642-MH27-8J6M MantisBT may disclose project names to unauthorized users

Impact Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. Patches The vulnerability has been fixed in MantisBT version 2.25.8...

com.liferay:com.liferay.wiki.layout.prototype (>=1.0.0 <=1.0.14) potentially affected by CVE-2023-42628 via com.liferay:com.liferay.wiki.web (>=1.0.0 <=3.0.0)

com.liferay:com.liferay.wiki.web MAVEN version =1.0.0, =1.0.0, =1.0.14 Source cves: CVE-2023-42628 Source advisory: OSV:GHSA-HV45-R2F5-FMHJ...

GHSA-HV45-R2F5-FMHJ Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Stored cross-site scripting XSS vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88...

Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

Stored cross-site scripting XSS vulnerability in the Wiki widget in Liferay Wiki Web before 7.0.95 from Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88...