GHSA-FJ6P-G234-RRV3 Exposure of Sensitive Information in moodle

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

Exposure of Sensitive Information in moodle

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

UBUNTU-CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

Design/Logic Flaw

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

CVE-2022-30598 concerns Moodle where the global search results could disclose author information for certain activities to users who should not have access. The connected documents reiterate an information-disclosure flaw in Moodle’s global search results, but do not provide explicit root-cause d...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

Moodle 信息泄露漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. Moodle suffers from an information disclosure vulnerability that stems from the fact that global search results may contain author...

Products.CMFPlone XSS in profile home_page property

A member of the Plone site could set javascript in the homepage property of their profile, and have this executed when a visitor clicks the home page link on the author page...

double-checked-cell is unmaintained

The author recommends switching to oncecell, which offers a superset of the functionality...

WordPress Plugin stafflist 3.1.2 - SQLi (Authenticated)

Exploit Title: WordPress Plugin stafflist 3.1.2 - SQLi Authenticated Date: 05-02-2022 Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/stafflist/ Version: 3.1.2 Tested on: Firefox Contact me: h at spidersilk.com Vulnerable Code: $w = isset$GET'search...

RUSTSEC-2022-0042 malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

Low-rent RAT Worries Researchers

For about the price of a cup of Starbucks latte, a hacker is renting out a remote access trojan designed to backdoor targeted networks. Dubbed as Dark Crystal RAT or DCRat, the malware is being peddled online to hackers in Russian by a lone rookie malware writer with a penchant for cut-rate...

Slideshow <= 2.3.1 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some of its Slideshow settings, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks PoC As author and above, create/edit a slideshow and put the following payload in the "Number of seconds the slide takes to slide in...

Enable SVG < 1.4.0 - Author+ Stored Cross Site Scripting via SVG

The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads PoC As an author or above, upload the below SVG file via the Media library: The XSS will be triggered when accessing the file directly, e.g...

Cross-site Scripting (XSS)

acs-aem-commons is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script via the a and b GET parameters in page compare when a victim with access to AEM Author visits the page...

Page Compare Reflected Cross-site Scripting (XSS) vulnerability

Impact ACS Commons version 5.1.x and earlier suffers from a Reflected Cross-site Scripting XSS vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitized. An attacker must provide a...