EUVD-2020-29035

Malware in sbrugna...

CVE-2021-36400

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

Design/Logic Flaw

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

CVE-2021-36400

CVE-2021-36400 : In Moodle, insufficient capability checks made it possible to remove other users’ calendar URL subscriptions. The connected documents indicate the issue is a permissions flaw within the Moodle calendar subscriptions feature, with the CVSS base score 5.3 (Medium) and a leading imp...

CVE-2021-36400

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

CVE-2021-36400: Incorrect Default Permissions

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions...

PT-2021-3690

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description The issue is related to errors in processing hypertext links, which can be exploited by a remote attacker to bypass security features. Insufficient capability checks in Moodle allow an attacke...

PYSEC-2021-82

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file...

CVE-2020-8138

A missing check for IPv4 nested inside IPv6 in Nextcloud server 17.0.1, 16.0.7, and 15.0.14 allowed a Server-Side Request Forgery SSRF vulnerability when subscribing to a malicious calendar URL...

Server side request forgery (ssrf)

A missing check for IPv4 nested inside IPv6 in Nextcloud server 17.0.1, 16.0.7, and 15.0.14 allowed a Server-Side Request Forgery SSRF vulnerability when subscribing to a malicious calendar URL...

CVE-2020-8138: Server-Side Request Forgery (SSRF)

A missing check for IPv4 nested inside IPv6 in Nextcloud server 17.0.1, 16.0.7, and 15.0.14 allowed a Server-Side Request Forgery SSRF vulnerability when subscribing to a malicious calendar URL...

CVE-2015-8685: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

PT-2016-3952

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions 3.8.3 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the external calendar URL or the bank name field in the import external calendar page. This can lead to...