39 matches found
GHSA-75V5-6885-59F9 AgentScope Cross-Origin Resource Sharing (CORS) vulnerability
A Cross-Origin Resource Sharing CORS vulnerability exists in modelscope/agentscope version v0.0.4. The CORS configuration on the agentscope server does not properly restrict access to only trusted origins, allowing any external domain to make requests to the API. This can lead to unauthorized dat...
Insufficient Access Control
Moodle is vulnerable to Insufficient Access Control. The vulnerability is due to improper validation in the external API for the Quiz module, allowing unauthorized users to override access controls...
Searching Opencast may cause a denial of service
Impact First noticed in Opencast 13 and 14, Opencast's Elasticsearch integration may generate syntactically invalid Elasticsearch queries in relation to previously acceptable search queries. From Opencast version 11.4 and newer, Elasticsearch queries are retried a configurable number of times in...
CVE-2024-43430
A flaw was found in moodle. External API access to Quiz can override contained insufficient access control...
CVE-2024-43430 Moodle: lack of access control when using external methods for quiz overrides
A flaw was found in moodle. External API access to Quiz can override contained insufficient access control...
CVE-2024-43430
Mode C: The CVE-2024-43430 entry concerns Moodle and describes an access-control weakness where external API access to Quiz can override contained access control. The connected documents reiterate Moodle-related details (external API for Quiz, insufficient access control) but do not specify affec...
Moodle 安全漏洞
Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from an Access Control Error vulnerability that stems from insufficient access control over the inclusion of an...
CVE-2024-43430: Incorrect Default Permissions
A flaw was found in moodle. External API access to Quiz can override contained insufficient access control...
CVE-2022-36923: Improper Handling of Exceptional Conditions
Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...
Command injection
Vulnerability in rand-quote and hitokoto plugins Description: the rand-quote and hitokoto fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use print -P to print them. If these quotes contained the proper symbols, they could trigger command...
CVE-2021-3727 OS Command Injection in ohmyzsh/ohmyzsh
Vulnerability in rand-quote and hitokoto plugins Description: the rand-quote and hitokoto fetch quotes from quotationspage.com and hitokoto.cn respectively, do some process on them and then use print -P to print them. If these quotes contained the proper symbols, they could trigger command...
CVE-2021-3727
CVE-2021-3727 concerns the ohmyzsh rand-quote and hitokoto plugins. The description states that quotes fetched from external APIs (quotationspage.com and hitokoto.cn) could, if containing certain symbols, trigger a command injection when processed and printed via print -P. The root cause is not d...
Boost Note 注入漏洞
Boost Note is an open source developer-friendly workspace with IDE-like UX. it provides the following features focusing on information management and searchability. A security vulnerability exists in Boost Note versions prior to 0.22.0 that stems from a lack of effective filtering and validation ...
GetSimple CMS 3.3.4 XML External Entity Injection Vulnerability
GetSimple CMS versions 3.1.1 through 3.3.4 suffer from an XML external entity injection vulnerability. ------------------------------------------------------------------ GetSimple CMS adddata$in; User input passed via the "data" POST parameter is not properly sanitized before being used in a call...
GetSimple CMS 3.3.4 XML External Entity Injection
------------------------------------------------------------------ GetSimple CMS adddata$in; User input passed via the "data" POST parameter is not properly sanitized before being used in a call to the "simplexmlloadstring" function at line 23. This can be exploited to carry out XML External Enti...
Sony Network Camera SNC-P5 1.0 - ActiveX viewer Heap Overflow PoC
No description provided by source. !-- Sony Network Camera SNC-P5 v1.0 ActiveX viewer Heap Overflow PoC Camera info http://bssc.sel.sony.com/BroadcastandBusiness/DisplayModel?id=79540 SNC-P5 External API documentation...
Sony Network Camera SNC-P5 v1.0 ActiveX viewer Heap Overflow PoC
No description provided by source. !-- Sony Network Camera SNC-P5 v1.0 ActiveX viewer Heap Overflow PoC Camera info http://bssc.sel.sony.com/BroadcastandBusiness/DisplayModel?id=79540 SNC-P5 External API documentation...
