PT-2026-21365

BigBlueButton is an open-source virtual classroom. In versions 3.0.19 and below, when first joining a session with the microphone muted, the client sends audio to the server regardless of mute state. Media is discarded at the server side, so it isn't audible to any participants, but this may allo...

WordPress Himer theme < 2.1.1 - Arbitrary Group Joining via CSRF vulnerability

Arbitrary Group Joining via CSRF vulnerability discovered by Sushmita Poudel in WordPress Theme Himer versions 2.1.1...

GHSA-P84V-GXVW-73PF Argo Workflow has a Zipslip Vulnerability

Vulnerability Description Vulnerability Overview 1. During the artifact extraction process, the unpack function extracts the compressed file to a temporary directory /etc.tmpdir and then attempts to move its contents to /etc using the rename system call, 2. However, since /etc is an already...

EUVD-2022-6983

Malicious code in bioql PyPI...

BIT-MOODLE-2024-38273 moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access...

CVE-2022-39203

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The...

CVE-2024-34659

Exposure of sensitive information in GroupSharing prior to version 13.6.13.3 allows remote attackers can force the victim to join the group...

CVE-2024-11716

While assignment of a user to a team bracket in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition is already ongoing. This issue impacts releas...

CVE-2024-2231 Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR

The allows any authenticated user to join a private group due to a missing authorization check on a function...

CVE-2024-2231 Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR

The allows any authenticated user to join a private group due to a missing authorization check on a function...

GHSA-X29X-QWVX-FXR2 Moodle BigBlueButton web service leaks meeting joining information

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access...

CVE-2024-38273 moodle: BigBlueButton web service leaks meeting joining information to users who should not have access

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access...

Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF

Description The theme does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack The PoC will be displayed on June 26, 2024, to give users the time to update...

Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF

Description The theme does not have CSRF checks in some places, which could allow attackers to make users join private groups via a CSRF attack PoC The PoC will be displayed on June 26, 2024, to give users the time to update...

CVE-2024-5132

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

[SECURITY] Debian 10 LTS will reach end-of-life on June 30th, 2024

Dear Debian LTS users, This is a gentle reminder that Debian 10 "buster" will reach end of support as the LTS release on June 30, 2024. Users are encouraged to upgrade to Debian 11 "bullseye". Starting in July, Debian will not provide further security updates for Debian 10. A subset of buster...

UBUNTU-CVE-2023-45283

The filepath package does not recognize paths with a ??\ prefix as special. On Windows, a path beginning with ??\ is a Root Local Device path equivalent to a path beginning with \?. Paths with a ??\ prefix may be used to access arbitrary locations on the system. For example, the path ??\c:\x...

A US Bill Would Ban Kids Under 13 From Joining Social Media

The legislation would insert the government into online platforms’ age-verification efforts—a move that makes some US lawmakers queasy...

CVE-2023-20100

A vulnerability in the access point AP joining process of the Control and Provisioning of Wireless Access Points CAPWAP protocol of Cisco IOS XE Software for Wireless LAN Controllers WLCs could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected...

CVE-2023-20100

CVE-2023-20100 concerns Cisco IOS XE Software for Wireless LAN Controllers (WLCs) CAPWAP join process. The vulnerability arises from a logic error during AP joining, enabling an unauthenticated, remote attacker to trigger a DoS by causing the affected device to restart. Exploitation involves addi...