CVE-2024-4711

CVE-2024-4711 affects the WordPress plugin WordPress Infinite Scroll – Ajax Load More. The vulnerability is a Stored Cross-Site Scripting (XSS) in the ajax_load_more shortcode, due to insufficient input sanitization and output escaping, exploitable by authenticated users with contributor-level pe...

CVE-2024-2933

CVE-2024-2933 affects the Page Builder Gutenberg Blocks – CoBlocks WordPress plugin. It is a Stored Cross-Site Scripting (XSS) vulnerability via the Social Profiles widget present in all versions up to 3.1.9, caused by insufficient input sanitization and output escaping on user-supplied attribute...

Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Checkpoint Quantum_Spark_Firmware

Exploit for CVE-2024-24919 Description This Python script...

CVE-2024-5138

The CVE-2024-5138 issue affects the snapd component snapctl. The root cause is improper parsing/validation of command-line arguments in snapctl, allowing an unprivileged user to trigger an authorised action on behalf of snapd that would normally require administrator privileges. This could lead t...

CVE-2024-34009

The CVE-2024-34009 issue is described across multiple sources as a vulnerability in Moodle where insufficient checks for ReCAPTCHA enablement allow bypassing checks on the login page, with no impact to other pages. Connected documents identify Moodle 4.3.x installations (prior to 4.3.4) as affect...

CVE-2024-34008

Moodle CSRF risk in analytics management of models: description repeatedly states missing CSRF token in admin tools for analytics models, enabling potential unauthorized admin actions. Root cause: lack of CSRF protection in the analytics-models admin interface. Documented across CVE-2024-34008 en...

CVE-2024-34007

The CVE-2024-34007 vulnerability concerns Moodle’s MFA logout functionality (admin/tool/mfa/auth.php) where the logout flow does not include a required CSRF token, exposing users to CSRF logout. Multiple connected sources (OSV, GHSA/GitHub advisories, Nessus/NVD, Ubuntu OSV) corroborate a CSRF ri...

CVE-2024-34006

CVE-2024-34006 affects Moodle via the site log log entry (config_log_created) where descriptions contain raw HTML. The root cause is unsanitized HTML in log content, enabling potential cross-site scripting. Documents reference OSV/GHSA entries and Moodle advisories confirming the issue; no explic...

CVE-2024-34005

CVE-2024-34005 describes an authenticated local file include (LFI) risk in Moodle in certain misconfigured shared hosting environments. Multiple connected sources (OSV entries, GHSA advisory, Nessus plugins) confirm a vulnerability where a user who has both access to restore database activity mod...

CVE-2024-34004

CVE-2024-34004 : In Moodle, in a shared hosting setup misconfigured to allow access to other users’ content, a user with both (a) permission to restore wiki modules and (b) direct access to the web server outside the Moodle webroot can trigger a local file inclusion. The connected sources describ...

CVE-2024-34003

CVE-2024-34003 corresponds to an authenticated local file include (LFI) risk in Moodle in misconfigured shared hosting environments, where a user with access to restore workshop modules and direct access to the web server outside of Moodle can exploit LFI. The connected documents (GHSA/JG4F-8W9X-...

CVE-2024-34002

Summary (CVE-2024-34002) In Moodle, in shared hosting environments misconfigured to expose other users’ content, a user with both access to restore feedback modules and direct access to the web server outside of Moodle’s webroot can trigger a local file include (LFI). Multiple connected sources (...

CVE-2024-34001

CVE-2024-34001 corresponds to a Moodle CSRF risk in the admin preset tool management of presets, arising from a missing token in actions performed by admins. The issue is documented across multiple sources (NVD/GHSA/OSV) and is described as a CSRF vulnerability without details about affected Mood...

CVE-2024-34000

The CVE-2024-34000 entry corresponds to a Moodle issue where ID numbers displayed in the lesson overview report require additional sanitizing to prevent a stored XSS risk. The OSV and NVD/NVD-derived entries confirm a stored XSS vulnerability in Moodle related to the lesson overview report, cause...

CVE-2024-33999

CVE-2024-33999 affects Moodle (BIT-MOODLE-2024-33999) via unsafe direct use of the referrer URL in admin/tool/mfa/index.php. The underlying issue is inadequate sanitization of $_SERVER['HTTP_REFERER'], as noted by multiple sources. This vulnerability is described as impacting Moodle installations...

CVE-2024-33998

The CVE-2024-33998 entry describes a stored XSS risk in Moodle caused by insufficient escaping of participants’ names on the participants page table. Reported effects occur when interacting with some features, and multiple connected documents (OSV/GHSA and related Nessus notes) confirm the XSS na...

CVE-2024-33997

Moodle has a stored XSS vulnerability (CVE-2024-33997) in the equation editor, triggered when editing another user’s equation. The issue stems from insufficient sanitizing, and sources consistently note that “additional sanitizing was required” to prevent the risk. The connected documents confirm...

CVE-2024-33996

CVE-2024-33996 relates to Moodle: the vulnerability stems from incorrect validation of allowed event types in the calendar web service. This weak validation can allow some users to create events with types or audiences they do not have permission to publish to, constituting a permission/ access-c...

CVE-2024-36845

Summary (CVE-2024-36845) : Affected software is libmodbus v3.1.6. The issue is an invalid pointer in modbus_receive() that can cause a Denial of Service when processing a crafted message sent to the unit-test-server. This is the same vulnerability pattern identified for libmodbus and is acknowled...

CVE-2024-36844

libmodbus 3.1.6 is affected by a use-after-free in the ctx->backend pointer, enabling denial of service via a crafted message to the unit-test-server. The issue is documented across multiple feeds (NVD entry CVE-2024-36844, Debian DLA-4084-1, and OSS/OSV records). Impact is a DoS; no remote co...