Moodle IDOR when deleting OAuth2 linked accounts

A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts...

CVE-2024-48897 Moodle: idor in edit/delete rss feed

A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify...

Fedora 37 : seamonkey (2022-3094c02073)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-3094c02073 advisory. Some stability fixes. ---- Update to 2.53.14 Note that besides the ordinary builds for the current Fedora and EPEL branches, there is an additional...

CVE-2024-10943

The CVE-2024-10943 entry relates to Rockwell Automation FactoryTalk Updater and describes an authentication bypass caused by shared secrets across accounts, potentially enabling a threat actor to impersonate a user when authentication information can be enumerated. Connected documents confirm the...

aoe: fix the potential use-after-free problem in more places

...

CVE-2024-50242 fs/ntfs3: Additional check in ntfs_file_release

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in ntfsfilerelease...

CVE-2024-50242

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in ntfsfilerelease...

Moodle Remote Code Execution vulnerability

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions...

CVE-2024-43425

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions...

MAL-2024-10397 Malicious code in puppeteer-extra-plugin-adblokcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50389c28817c90850d22eeb10abc234f6b3cd67eb0c8677c347551931d46144c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-20107

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09124360; Issue ID: MSV-1823...

Remote Code Execution (RCE)

Overview studio-42/elfinder is an open-source file manager for web, written in JavaScript using jQuery UI. Affected versions of this package are vulnerable to Remote Code Execution RCE due to the lack of restrictions on file types that can be uploaded, specifically the .php8 extension. An attacke...

CVE-2024-44229

An information leakage was addressed with additional validation. This issue is fixed in visionOS 2.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, Safari 18.1. Private browsing may leak some browsing history...

CVE-2024-21172

Vulnerability in the Oracle Hospitality OPERA 5 product of Oracle Hospitality Applications component: Opera Servlet. Supported versions that are affected are 5.6.19.19, 5.6.25.8 and 5.6.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to...

YushuTechUnitreeGo1

Based on the provided code, it appears to be a Windows executable file PE file that contains a malicious payload. The file is encoded with a custom algorithm, making it difficult to analyze without decoding. The code is written in C and uses various techniques to evade detection, including: 1. Co...

CVE-2024-7433 Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection

The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is...

VulnCheck KEV: CVE-2023-3368

Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. This is a bypass of CVE-2023-34960...

Ubuntu: Security Advisory (USN-7007-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 40 Update: python3.13-3.13.0~rc2-1.fc40

Python 3.13 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.13 package provides the "python3.13" executable:...

CVE-2024-8696: Improper Neutralization of Input During Web Page Generation

A remote code execution RCE vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2...