CVE-2024-3179

Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The...

Improper Access Control

moodle/moodle is vulnerable to Improper Access Control. This vulnerability is due to a failure to honor Separate Groups mode restrictions, allowing users from different groups to be displayed. By default, this provides additional access to non-editing teachers...

BIT-MOODLE-2024-25981 Msa-24-0004: forum export did not respect activity group settings

Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers...

Smart Forms < 2.6.94 - Edit Entries via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk. PoC CSRF PoC...

The vulnerability of the Kofax PowerPDF software for creating, converting, editing, and publishing PDF files lies in the fact that operations are performed outside of the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Kofax PowerPDF software for creating, converting, editing, and publishing PDF files is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created PDF file...

CVE-2024-28667

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via the component /dede/templetsoneedit.php...

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

Code injection

Numbas editor before 7.3 mishandles editing of themes and extensions...

CVE-2024-23238

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to edit NVRAM variables...

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

CVE-2024-27612

Numbas editor prior to version 7.3 mishandles editing of themes and extensions, leading to potential remote code execution (as evidenced by public exploits for ≤7.2). Public advisories (PT-2024-21967) recommend updating to 7.3 or later to resolve the issue.

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

[SECURITY] Fedora 40 Update: jline2-2.14.6-12.fc40

JLine is a Java library for handling console input. It is similar in functionality to BSD editline and GNU readline. People familiar with the readline/editline capabilities for modern shells such as bash and tcsh will find most of the command editing features of JLine to be familiar...

PT-2024-21967 · Unknown · Numbas Editor

Name of the Vulnerable Software and Affected Versions: Numbas editor versions prior to 7.3 Description: The issue concerns the mishandling of editing themes and extensions in the Numbas editor. Recommendations: For versions prior to 7.3, update to version 7.3 or later to resolve the issue...

BIT-GITLAB-2020-13338

An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references...

BIT-MOODLE-2022-40316

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to...

Pegasystem PEGA Platform Cross-Site Scripting Vulnerability

Pegasystem PEGA Platform is a suite of application development platforms from the US-based Pegasystem. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-Time Decision Making and CRM Customer Relationship Management. A cross-site scripting...

PT-2024-13874 · Pegasystems · Pega Platform

Name of the Vulnerable Software and Affected Versions: Pega Platform versions 7.1.7 through 23.1.1 Description: The issue is related to an XSS problem when editing or rendering user HTML content. Recommendations: For Pega Platform versions 7.1.7 through 23.1.1, update to a version that includes a...

PT-2024-21973

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.19 Description The issue is related to Server-Side Template Injection SSTI within the Design Manager, specifically when editing the Breadcrumbs. Recommendations For CMS Made Simple version 2.2.19, consider disabling...