1098 matches found
PT-2024-33258 · Moodle +1 · Moodle +1
Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A vulnerability was found in Moodle, where additional checks are required to ensure users can only fetch the list of course badges for courses that they are intended to have access to...
Moodle's IDOR in badges allows deletion of arbitrary badges
A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access...
GHSA-WWJF-GWRV-WH45 Moodle's IDOR in badges allows deletion of arbitrary badges
A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access...
CVE-2024-43431 Moodle: idor in badges allows deletion of arbitrary badges
A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access...
CVE-2024-43431
CVE-2024-43431 affects Moodle via an IDOR in badges: insufficient capability checks allow deleting badges a user should not access. The Connected OSV entry BIT-MOODLE-2024-43431 corroborates the IDOR focus in badges (no patch/version details provided in the documents). CVSS 3.1 base score 7.5 (HI...
CVE-2024-43431 Moodle: idor in badges allows deletion of arbitrary badges
A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access...
CVE-2024-47180 Shields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badges
Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version server-2024-09-25 are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic...
CVE-2024-47180 Shields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badges
Shields.io is a service for concise, consistent, and legible badges in SVG and raster format. Shields.io and users self-hosting their own instance of shields using version server-2024-09-25 are vulnerable to a remote execution vulnerability via the JSONPath library used by the Dynamic...
Shields 注入漏洞
Shields is a project of Shields open source. An injection vulnerability exists in versions prior to Shields server-2024-09-25, which stems from the JSONPath library used via dynamic JSON/Toml/Yaml badges that can be used against Shields.io instances...
PT-2024-32462 · Jsonpath +1 · Jsonpath +1
Name of the Vulnerable Software and Affected Versions: Shields.io versions prior to server-2024-09-25 Description: The issue concerns a remote execution vulnerability via the JSONPath library used by the Dynamic JSON/Toml/Yaml badges. This vulnerability allows any user with access to make a reque...
MAL-2024-8852 Malicious code in roblox-badges (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 631332631f47abd7acead3d283e6d06c693fe8e56c3f235bb0855b8fce3fe8a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in roblox-badges (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 631332631f47abd7acead3d283e6d06c693fe8e56c3f235bb0855b8fce3fe8a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Reddit: IDOR lets a malicious user reveal the unpinned achievement badges of any Reddit user
Vulnerability description not provided...
Exploit for CVE-2024-4956
Badges !MIT Licensehttps://img.shields.io/badge/Licens...
Revolutionizing WordPress Bug Bounty and Security: Latest Enhancements to the Wordfence Bug Bounty Program
We are excited to share some updates on our Bug Bounty Program today! It has been over six months since the launch of our program, during which weve awarded approximately $242,000 in bounties. Since then, our team has triaged around 2,140 vulnerability submissions, with about 1,320 deemed in-scop...
WordPress Follow Us Badges plugin <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via wpsitefollowusbadges Shortcode vulnerability discovered by Lucio Sá in WordPress Plugin Follow Us Badges versions = 3.1.10...
WordPress Follow Us Badges Plugin <= 3.1.10 is vulnerable to Cross Site Scripting (XSS)
Software Follow Us Badges Type Plugin Vulnerable versions = 3.1.10 Fixed in 3.1.11 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3280 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b115b59a801a Credits Lucio Sá Required...
PT-2024-24873 · WordPress · Follow Us Badges
Name of the Vulnerable Software and Affected Versions: Follow Us Badges plugin for WordPress versions up to, and including, 3.1.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's wpsite follow us badges shortcode due to insufficient input sanitization and output...
Follow Us Badges < 3.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode
Description The Follow Us Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsitefollowusbadges shortcode in all versions up to, and including, 3.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...