HPESBST04630 rev.1 - HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege

Potential Security Impact: Local: Elevation of Privilege, Unquoted Search Path SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE MSA 1040 SAN Storage - Prior to v4.1.3.83 HPE MSA 1050 SAN Storage - Prior to v4.1.3.83 HPE MSA 1060 Storage - Prior to v4.1.3.83 HPE MSA 2040 SAN...

CVE-2024-25983 Msa-24-0006: idor on dashboard comments block

Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available e.g., on their profile page...

CVE-2024-25982 Msa-24-0005: csrf risk in language import utility

The link to update all installed language packs did not include the necessary token to prevent a CSRF risk...

CVE-2024-25982 Msa-24-0005: csrf risk in language import utility

The link to update all installed language packs did not include the necessary token to prevent a CSRF risk...

CVE-2024-25980 Msa-24-0003: h5p attempts report did not respect activity group settings

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers...

CVE-2024-25980 Msa-24-0003: h5p attempts report did not respect activity group settings

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers...

CVE-2024-25978 Msa-24-0001: denial of service risk in file picker unzip functionality

Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality...

Moodle 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities (MSA-23-0035, MSA-23-0038)

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

CVE-2023-30910

HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests...

CVE-2023-30910

HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests...

Design/Logic Flaw

HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests...

CVE-2023-30910

Impact: HPE MSA Controller before IN210R004 has a vulnerability that could allow remote interpretation of HTTP requests, potentially enabling an attacker to manipulate requests. Affected product: HPE MSA Controller, version prior to IN210R004. Root cause: inconsistent interpretation of HTTP reque...

CVE-2023-30910

HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests...

PT-2023-23041 · Hewlett Packard · Hpe Msa Controller

Name of the Vulnerable Software and Affected Versions: HPE MSA Controller versions prior to IN210R004 Description: The issue allows for inconsistent interpretation of HTTP requests, which could be remotely exploited. Recommendations: For versions prior to IN210R004, update to version IN210R004 or...

CVE-2023-30910: Inconsistent Interpretation of HTTP Requests

HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests...

HPE MSA Storage SLP Detection

Binary data hpemsastorageslpdetect.nbin...

HPE MSA Storage Session Reuse (HPESBST03940)

The version of HPE MSA Storage installed on the remote host is prior to GL225P002-02, VE270P002-02, or VL270P002-02. It is, therefore, affected by a vulnerability as referenced in the HPESBST03940 advisory. - A remote session reuse vulnerability leading to access restriction bypass was discovered...

Azure AD Token Forging Technique in Microsoft Attack Extends Beyond Outlook, Wiz Reports

The recent attack against Microsoft's email infrastructure by a Chinese nation-state actor referred to as Storm-0558 is said to have a broader scope than previously thought. According to cloud security company Wiz, the inactive Microsoft account MSA consumer signing key used to forge Azure Active...

Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organizations via Forged Azure AD Tokens

Microsoft on Friday said a validation error in its source code allowed for Azure Active Directory Azure AD tokens to be forged by a malicious actor known as Storm-0558 using a Microsoft account MSA consumer signing key to breach two dozen organizations. "Storm-0558 acquired an inactive MSA consum...

Moodle Multiple Vulnerabilities (MSA-23-0017, MSA-23-0018)

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...