CVE-2023-23611

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

PYSEC-2023-21

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

Authorization

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

Open edX 安全漏洞

EDX Open edX is an online learning management system from EDX Corporation, USA. A security vulnerability exists in Open edX XBlock version 7.0.0 to versions prior to 7.2.2, which stems from a lack of authorization management...

CVE-2023-23611

The CVE-2023-23611 entry concerns the LTI Consumer XBlock for Open edX. Affected: LTI Consumer XBlock versions 7.0.0 and above, before 7.2.2. Issue: Missing Authorization allows any integrated LTI tool to post grades for any LTI XBlock by guessing the block location via the resource_link_id, comp...

CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

CVE-2023-23611 xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation

LTI Consumer XBlock implements the consumer side of the LTI specification enabling integration of third-party LTI provider tools. Versions 7.0.0 and above, prior to 7.2.2, are vulnerable to Missing Authorization. Any LTI tool that is integrated with on the Open edX platform can post a grade back...

PT-2023-19073 · Open Edx · Lti Consumer Xblock

Name of the Vulnerable Software and Affected Versions: LTI Consumer XBlock versions 7.0.0 through 7.2.2 Description: The LTI Consumer XBlock implements the consumer side of the LTI specification, enabling integration of third-party LTI provider tools. Any LTI tool integrated with the Open edX...

GHSA-QV6C-367R-3W6Q XBlock vulnerable to Cross-Site Scripting (XSS)

Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. Workarounds...

XBlock vulnerable to Cross-Site Scripting (XSS)

Impact XSS Vulnerability in multiple XBlock Fields. Any platform that has deployed the XBlock will be impacted. Patches https://github.com/openedx/xblock-drag-and-drop-v2/commit/53c4482f9bb6d8c7ccdf5253bd82c84a222b2492 The fix is compatible with all Open edX releases newer than Lilac. Workarounds...

Drag and Drop XBlock v2 跨站脚本漏洞

Drag and Drop XBlock v2 is an Open edX open source SDK package for online education sites. Implements a drag and drop problem where the learner must drag items to areas on the target image. A cross-site scripting vulnerability exists in Drag and Drop XBlock v2 versions prior to 3.0.0. An attacker...

Backdoor.Win32.DarkSky.23 MVID-2022-0648 Buffer Overflow

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/1164ef21ef2af97e0339359c0dce5e7d.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.DarkSky.23 Vulnerability: Remote Stack Buffer Overflow SEH Description: The...

MAL-2022-2672 Malicious code in edx-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a45186001f92d46e485ade8cdd9152dabbe881415b90667398d14c43d98bda4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-32195

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...

CVE-2022-32195

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...

CVE-2022-32195

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...

Design/Logic Flaw

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...

CVE-2022-32195

Open edX platforms released before 2022-06-06 are vulnerable to a cross-site scripting (XSS) flaw via the next parameter in the logout URL. The issue is reflected XSS affecting the logout flow, enabling injected scripts to execute in users’ browsers on pages that read the next parameter. The CVSS...

CVE-2022-32195

Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL...

EDX Open edX 跨站脚本漏洞

EDX Open edX is an online learning management system from EDX Corporation, USA. A security vulnerability exists in EDX Open edX versions prior to 2022-06-06. The vulnerability is exploited to conduct a cross-site scripting attack via the "next" parameter in the deregistration URL...