79 matches found
CVE-2023-48249
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users...
Design/Logic Flaw
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users...
CVE-2023-48249
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the application OS user “root” via a crafted HTTP request. By abusing this vulnerability, it is possible to steal session cookies of other active users...
CVE-2023-48249
The CVE-2023-48249 entry concerns Bosch Nexo Cordless Nutrunner devices. Affected component: the application layer handling HTTP requests on these devices. Root cause: an authenticated remote attacker can enumerate arbitrary folders across all system paths under the application OS user (root) via...
CVE-2023-30585
A vulnerability has been identified in the Node.js .msi version installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM...
CVE-2023-30585
A vulnerability has been identified in the Node.js .msi version installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM...
PT-2023-6498 · Dell · Dell Digital Delivery
Name of the Vulnerable Software and Affected Versions: Dell Digital Delivery versions prior to 5.0.82.0 Description: The issue is related to an Insecure Operation on Windows Junction / Mount Point vulnerability. A local malicious user could potentially exploit this vulnerability to create arbitra...
SUSE CVE-2023-30585
A vulnerability has been identified in the Node.js .msi version installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM...
Improper Access Control
moodle/moodle is vulnerable to Improper Access Control. The vulnerability exists in parsefileinformationfromurl function of lang.php and loader.php due to improper folder restrictions which allows an attacker to send a specially crafted HTTP request and create arbitrary folders on the system...
Snow Monkey Forms < 5.0.7 - Unauthenticated Path Traversal
The plugin does not validate file path, allowing unauthenticated users to upload files to arbitrary folders...
Fedora 38 : moodle (2023-0ab503de3d)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-0ab503de3d advisory. Fixes for CVE-2023-30943 and CVE-2023-30944. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...
Fedora 37 : moodle (2023-60a90b6e6a)
The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-60a90b6e6a advisory. Fixes for CVE-2023-30943 and CVE-2023-30944. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...
Fedora 36 : moodle (2023-49eb814ccc)
The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-49eb814ccc advisory. Fixes for CVE-2023-30943 and CVE-2023-30944. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...
Moodle External Control of File Name or Path vulnerability
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...
GHSA-22GJ-8QJ2-FJ46 Moodle External Control of File Name or Path vulnerability
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...
CVE-2023-30943
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...
Path traversal
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...
UBUNTU-CVE-2023-30943
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...
Moodle 安全漏洞
Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from allowing a user to control the path of old files to be created in the TinyMCE...
CVE-2023-30943 Moodle: tinymce loaders susceptible to arbitrary folder creation
The vulnerability was found Moodle which exists because the application allows a user to control path of the older to create in TinyMCE loaders. A remote user can send a specially crafted HTTP request and create arbitrary folders on the system...