Pixelmon Mod MCPE - Base64 encoded String, Exported ContentProvider, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Pixelmon Mod MCPE published at the 'play' market has multiple vulnerabilities...

Pixelmon Mod MCPE - Base64 encoded String, Exported ContentProvider, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Pixelmon Mod MCPE published at the 'play' market has multiple vulnerabilities...

Building Ideas MCPE HOUSE MOD - Dynamic Code Loading, External URLs, SD-card access vulnerabilities

HackApp vulnerability scanner discovered that application Building Ideas MCPE HOUSE MOD published at the 'play' market has multiple vulnerabilities...

Flan's Mod for Minecraft - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Flan's Mod for Minecraft published at the 'play' market has multiple vulnerabilities...

PT-2016-1626

Name of the Vulnerable Software and Affected Versions ProFTPD versions prior to 1.3.5b ProFTPD versions prior to 1.3.6rc2 Description The issue exists due to improper handling of the TLSDHParamFile directive in the mod tls module. This could lead to the use of a weaker than intended Diffie-Hellma...

PT-2016-5037

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.6.11 Moodle versions 2.7.x before 2.7.13 Moodle versions 2.8.x before 2.8.11 Moodle versions 2.9.x before 2.9.5 Moodle versions 3.0.x before 3.0.3 Description A cross-site request forgery CSRF issue allows remote...

Moodle mod_data advanced search cross-site scripting vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A cross-site scripting vulnerability exists in the moddata advanced search in Moodle...

Moodle Access Bypass

The vulnerability of the mod/forum/post.php function in the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions through group-based authenticatio...

PT-2016-1331

Name of the Vulnerable Software and Affected Versions OpenSSL versions 1.0.1 through 1.0.1s OpenSSL versions 1.0.2 through 1.0.2g Description The issue is related to the MOD EXP CTIME COPY FROM PREBUF function in OpenSSL, which does not properly consider cache-bank access times during modular...

CVE-2015-3275

Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...

CVE-2015-5338

Multiple cross-site request forgery CSRF vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to 1 mod/lesson/mediafile.php or 2...

PT-2016-1289

Name of the Vulnerable Software and Affected Versions Moodle versions 2.9.x through 2.9.0 Description The issue is related to insufficient access control in the mod/forum/post.php function of the Moodle learning management system. This can be exploited by a remote attacker to bypass existing acce...

CVE-2015-3273: Undefined Security Weakness

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization...

CVE-2015-3275: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to 1 mod/scorm/player.php or 2...

CVE-2015-5338: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to 1 mod/lesson/mediafile.php or 2...

CVE-2015-5265: Undefined Security Weakness

The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button i...

Unspecified vulnerability in Prosody mod_dialback module

Prosody is a suite of Jabber/XMPP communication server software written in Lua. moddialback is one of the authentication modules used for communication between local servers. A security vulnerability exists in the 'generatedialback' function in the moddialback module in versions of Prosody prior ...

PT-2016-4403

Name of the Vulnerable Software and Affected Versions Prosody versions prior to 0.9.10 Description The issue arises from the generate dialback function in the mod dialback module, which fails to properly separate fields when generating dialback keys. This allows remote attackers to spoof XMPP...

httpd: bypass of mod_headers rules via chunked requests

A flaw was found in the way httpd handled HTTP Trailer headers when processing requests using chunked encoding. A malicious client could use Trailer headers to set additional HTTP headers after header processing was performed by other modules. This could, for example, lead to a bypass of header...

raf.mod.uk XSS vulnerability

Vulnerable URL: http://www.raf.mod.uk/aircadets/newsandevents/index.cfm?tag=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| Yes, at 13.03.2017 Latest check for patch:| 13.03.2017 12:09 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclos...