The vulnerability of the Grafana monitoring and observation platform lies in its permission list for authorized access, which allows a violator to increase their privileges.

The vulnerability of the Grafana monitoring and observation platform relates to administrator permissions. Administrators have the ability to change the permissions associated with organizational viewing roles, organizational editors, and organizational administrators. Exploiting this vulnerabili...

Concrete CMS Stored XSS in the Custom Class page editing

Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The...

CVE-2024-3179

Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The...

CVE-2024-3179

Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page editing. Prior to the fix, a rogue administrator could insert malicious code in the custom class field due to insufficient validation of administrator provided data. The...

Improper Access Control

moodle/moodle is vulnerable to Improper Access Control. This vulnerability is due to a failure to honor Separate Groups mode restrictions, allowing users from different groups to be displayed. By default, this provides additional access to non-editing teachers...

BIT-MOODLE-2024-25981 Msa-24-0004: forum export did not respect activity group settings

Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers...

Smart Forms < 2.6.94 - Edit Entries via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks, such as editing entries, and we consider it a medium risk. PoC CSRF PoC...

The vulnerability of the Kofax PowerPDF software for creating, converting, editing, and publishing PDF files lies in the fact that operations are performed outside of the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of the Kofax PowerPDF software for creating, converting, editing, and publishing PDF files is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created PDF file...

CVE-2024-28667

DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via the component /dede/templetsoneedit.php...

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

Code injection

Numbas editor before 7.3 mishandles editing of themes and extensions...

CVE-2024-23238

An access issue was addressed with improved access restrictions. This issue is fixed in macOS Sonoma 14.4. An app may be able to edit NVRAM variables...

CVE-2024-27612

The Numbas editor (versions 7.2 and below ) is vulnerable to Remote Code Execution (RCE) due to the mishandling of theme and extension edits. This Improper Input Validation (CWE-20) allows an attacker to execute arbitrary code on a target system. Proof-of-concept exploits are available, such as t...

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

CVE-2024-27612

Numbas editor before 7.3 mishandles editing of themes and extensions...

[SECURITY] Fedora 40 Update: jline2-2.14.6-12.fc40

JLine is a Java library for handling console input. It is similar in functionality to BSD editline and GNU readline. People familiar with the readline/editline capabilities for modern shells such as bash and tcsh will find most of the command editing features of JLine to be familiar...

PT-2024-21967 · Unknown · Numbas Editor

Name of the Vulnerable Software and Affected Versions: Numbas editor versions prior to 7.3 Description: The issue concerns the mishandling of editing themes and extensions in the Numbas editor. Recommendations: For versions prior to 7.3, update to version 7.3 or later to resolve the issue...

BIT-GITLAB-2020-13338

An issue has been discovered in GitLab affecting versions prior to 12.10.13, 13.0.8, 13.1.2. A stored cross-site scripting vulnerability was discovered when editing references...

BIT-MOODLE-2022-40316

The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to...