231554 matches found
CVE-2024-34006
CVE-2024-34006 affects Moodle via the site log log entry (config_log_created) where descriptions contain raw HTML. The root cause is unsanitized HTML in log content, enabling potential cross-site scripting. Documents reference OSV/GHSA entries and Moodle advisories confirming the issue; no explic...
CVE-2024-34005
CVE-2024-34005 describes an authenticated local file include (LFI) risk in Moodle in certain misconfigured shared hosting environments. Multiple connected sources (OSV entries, GHSA advisory, Nessus plugins) confirm a vulnerability where a user who has both access to restore database activity mod...
CVE-2024-34004
CVE-2024-34004 : In Moodle, in a shared hosting setup misconfigured to allow access to other users’ content, a user with both (a) permission to restore wiki modules and (b) direct access to the web server outside the Moodle webroot can trigger a local file inclusion. The connected sources describ...
CVE-2024-34003
CVE-2024-34003 corresponds to an authenticated local file include (LFI) risk in Moodle in misconfigured shared hosting environments, where a user with access to restore workshop modules and direct access to the web server outside of Moodle can exploit LFI. The connected documents (GHSA/JG4F-8W9X-...
CVE-2024-34002
Summary (CVE-2024-34002) In Moodle, in shared hosting environments misconfigured to expose other users’ content, a user with both access to restore feedback modules and direct access to the web server outside of Moodle’s webroot can trigger a local file include (LFI). Multiple connected sources (...
CVE-2024-34001
CVE-2024-34001 corresponds to a Moodle CSRF risk in the admin preset tool management of presets, arising from a missing token in actions performed by admins. The issue is documented across multiple sources (NVD/GHSA/OSV) and is described as a CSRF vulnerability without details about affected Mood...
CVE-2024-34000
The CVE-2024-34000 entry corresponds to a Moodle issue where ID numbers displayed in the lesson overview report require additional sanitizing to prevent a stored XSS risk. The OSV and NVD/NVD-derived entries confirm a stored XSS vulnerability in Moodle related to the lesson overview report, cause...
CVE-2024-33999
CVE-2024-33999 affects Moodle (BIT-MOODLE-2024-33999) via unsafe direct use of the referrer URL in admin/tool/mfa/index.php. The underlying issue is inadequate sanitization of $_SERVER['HTTP_REFERER'], as noted by multiple sources. This vulnerability is described as impacting Moodle installations...
CVE-2024-33998
The CVE-2024-33998 entry describes a stored XSS risk in Moodle caused by insufficient escaping of participants’ names on the participants page table. Reported effects occur when interacting with some features, and multiple connected documents (OSV/GHSA and related Nessus notes) confirm the XSS na...
CVE-2024-33997
Moodle has a stored XSS vulnerability (CVE-2024-33997) in the equation editor, triggered when editing another user’s equation. The issue stems from insufficient sanitizing, and sources consistently note that “additional sanitizing was required” to prevent the risk. The connected documents confirm...
CVE-2024-33996
CVE-2024-33996 relates to Moodle: the vulnerability stems from incorrect validation of allowed event types in the calendar web service. This weak validation can allow some users to create events with types or audiences they do not have permission to publish to, constituting a permission/ access-c...
CVE-2024-36845
Summary (CVE-2024-36845) : Affected software is libmodbus v3.1.6. The issue is an invalid pointer in modbus_receive() that can cause a Denial of Service when processing a crafted message sent to the unit-test-server. This is the same vulnerability pattern identified for libmodbus and is acknowled...
CVE-2024-36844
libmodbus 3.1.6 is affected by a use-after-free in the ctx->backend pointer, enabling denial of service via a crafted message to the unit-test-server. The issue is documented across multiple feeds (NVD entry CVE-2024-36844, Debian DLA-4084-1, and OSS/OSV records). Impact is a DoS; no remote co...
CVE-2024-23316
CVE-2024-23316 affects Ping Identity PingAccess. All versions prior to 8.0.1 are vulnerable to HTTP request desynchronization that allows a crafted HTTP header to induce a request-smuggling condition for proxied requests. This is a network‑vector issue with high impact (CVSS 4.0 base score 8.8) a...
CVE-2024-5564
CVE-2024-5564 affects libndp, a library used by NetworkManager to handle IPv6 Neighbor Discovery. The issue is a buffer overflow triggered by a malformed IPv6 router advertisement due to improper validation of route length information, allowing a local attacker with user privileges to exploit the...
CVE-2024-29825
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code...
CVE-2024-29823
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code...
CVE-2024-29824
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code...
CVE-2023-38551
A CRLF Injection vulnerability in Ivanti Connect Secure 9.x, 22.x allows an authenticated high-privileged user to inject malicious code on a victim’s browser, thereby leading to cross-site scripting attack...