CVE-2019-18280

CVE-2019-18280 affects Sourcecodester Online Grading System 1.0. The vulnerability is a CSRF weakness due to lack of CSRF protection, allowing an attacker to trick an administrator into executing actions via a crafted HTML page, as demonstrated by a Create User action at the admin/modules/user/co...

CVE-2019-18280

Sourcecodester Online Grading System 1.0 is affected by a Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code via a crafted HTML page, as demonstrated by a Create User action at the...

PT-2019-15362

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Grading System version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands via the student, instructor, department, room, class, or user page using the id or classid parameter. This is due ...

CVE-2019-18280: Cross-Site Request Forgery (CSRF)

Sourcecodester Online Grading System 1.0 is affected by a Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code via a crafted HTML page, as demonstrated by a Create User action at the...

CVE-2019-18344: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodester Online Grading System 1.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the student, instructor, department, room, class, or user page id or classid parameter...

PT-2019-15308

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Grading System version 1.0 Description The issue is related to a lack of CSRF protection, which could allow an attacker to trick the administrator into executing arbitrary code via a crafted HTML page. This can be...

Apple Updates Privacy Policies After Siri Audio Recording Backlash

Apple is taking steps to improve the privacy of audio collected by its Siri voice assistant, on the heels of backlash around a program that let contractors listen into Siri conversations. On Wednesday, the phone giant apologized for violating users’ privacy through the program, which was...

Apple Suspends Siri Program After Privacy Backlash

Apple is suspending a program that lets contractors listen in on Siri voice recordings after facing a rain of backlash regarding the privacy implications of the program. The suspension comes after a report in The Guardian last week outlining how contractors regularly listen to intimate voice...

Cross-Site Scripting (XSS)

Moodle is vulnerable to cross-site scriptingXSS attacks. The attacks are possible because the application does not use the RISKXSS flag in mod/quiz/db/access.php, allowing attackers to use this loophole when providing gradebook feedback for manual quiz grading...

Multiple Cross-Site Request Forgery (CSRF)

Moodle is vulnerable to multiple cross-site request forgery CSRF attacks. The attacks exist because mod/assign/locallib.php does not properly handle session checking in Assignment's quick-grading, allowing any authenticated user to perform the attacks...

SSL Labs Grading Redesign (Preview 1)

We’re excited to share with you the first preview of our next-generation grading. This is something that’s long overdue but, due to lack of available time, we managed to keep up patching the first-generation grading to keep up with the times. Now, finally, we’re taking the next necessary steps to...

Moodle 2.6.x < 2.6.11 / 2.7.x < 2.7.8 Multiple Vulnerabilities

Binary data 9426.prm...

goedkoopstespeelgoedwinkel.nl XSS vulnerability

Vulnerable URL: http://www.goedkoopstespeelgoedwinkel.nl/zoeken.php?sq=" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2703389 VIP website status:| No Check...

fusacq.com XSS vulnerability

Vulnerable URL: http://www.fusacq.com/search-cession-entreprise?motscles=%22%3E%3Csvg/onload=alert%28/XSSPOSED/%29%3Emoins=1=0pays=0region=0secteuractivite=0respage=10=1recherche=3=21 Details: Description| Value ---|--- Patched:| Yes, at 23.11.2017 Latest check for patch:| 23.11.2017 08:39 GMT...

mcm.fr XSS vulnerability

Vulnerable URL: http://www.mcm.fr/search/home/actu/?q=%22%3E%3Cscript%3Ealert%28%27XSSPOSED%27%29;%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 17:55 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa...

cleanvideosearch.com XSS vulnerability

Vulnerable URL: http://www.cleanvideosearch.com/media/action/yt/search?button=Search==-1=1=0=false==%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FXSSPOSED%2F%29%3E=9 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:|...

indonesiayp.com XSS vulnerability

Vulnerable URL: http://www.indonesiayp.com/browse-business-cities/char:A" Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 461138 Google Pagerank| 3 VIP website status:| No Check...

tce.mg.gov.br XSS vulnerability

Vulnerable URL: http://www.tce.mg.gov.br/projetocontas/index.shtml!prettyPhotoiframes//0,%3Cimg%20src=x%20onerror=alert%28/XSSPOSED/%29%3E/ Details: Description| Value ---|--- Patched:| Yes, at 25.07.2017 Latest check for patch:| 25.07.2017 12:21 GMT Vulnerability type:| XSS Vulnerability status:...

Cross site scripting

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...

UBUNTU-CVE-2015-3174

mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISKXSS bit for graders, which allows remote authenticated users to conduct cross-site scripting XSS attacks via crafted gradebook feedback during manual quiz grading...