Lucene search
+L

231584 matches found

CVE
CVE
added 2024/02/19 7:53 p.m.86 views

CVE-2024-25634

Summary (CVE-2024-25634) : alf.io, an open-source ticket reservation system, is affected by an insecure access control flaw (IDOR) that, prior to version 2.0-Mr-2402, allows an attacker to read email logs of other organizers by sending a specially crafted request. The issue targets the data expos...

7.2CVSS6.6AI score0.00748EPSS
SaveExploits1References1Affected Software1
CVE
CVE
added 2024/02/19 7:48 p.m.101 views

CVE-2024-25635

CVE-2024-25635 affects alf.io prior to 2.0-Mr-2402, where an IDOR flaw in the /admin/api/users/ endpoint allows organization owners to view other org owners’ API KEYs and USERS. Root cause: improper access control on user data exposure; consequence is potential leakage of API credentials and sens...

8.8CVSS8.7AI score0.00716EPSS
SaveExploits1References1Affected Software1
Prion
Prion
added 2024/02/19 5:15 p.m.17 views

Input validation

Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available e.g., on their profile page...

3.5CVSS7.1AI score0.00602EPSS
SaveExploits0References4
Prion
Prion
added 2024/02/19 5:15 p.m.17 views

Design/Logic Flaw

Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality...

5CVSS7.1AI score0.00944EPSS
SaveExploits0References4
Prion
Prion
added 2024/02/19 5:15 p.m.27 views

Default configuration

Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers...

4CVSS7.2AI score0.00581EPSS
SaveExploits0References4
Prion
Prion
added 2024/02/19 5:15 p.m.22 views

Cross site request forgery (csrf)

The link to update all installed language packs did not include the necessary token to prevent a CSRF risk...

4.3CVSS7.2AI score0.005EPSS
SaveExploits0References4
Prion
Prion
added 2024/02/19 5:15 p.m.23 views

Default configuration

Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers...

4CVSS7.1AI score0.00533EPSS
SaveExploits0References4
CVE
CVE
added 2024/02/19 4:32 p.m.122 views

CVE-2024-25982

CVE-2024-25982 corresponds to a CSRF risk in Moodle where the update-link for language packs did not include the necessary token. The OSV/GHSA entries explicitly describe a cross-site request forgery risk in moodle’s language import/update flow, caused by the missing CSRF token. Documented impact...

8.8CVSS4.8AI score0.005EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2024/02/19 4:32 p.m.117 views

CVE-2024-25981

CVE-2024-25981 affects Moodle: Separate Groups mode restrictions were not honored during a forum export, causing data from all groups to be exported. By default this granted additional access to non-editing teachers. The connected documents confirm this is a Moodle forum export behavior issue; no...

5.3CVSS4.8AI score0.00581EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2024/02/19 4:32 p.m.121 views

CVE-2024-25980

CVE-2024-25980 affects Moodle’s H5P attempts report where Separate Groups mode restrictions were not honored, allowing visibility of users from other groups. The issue is described across multiple feeds (NVD entry for CVE-2024-25980, OSV entries, and Nessus/NASL summaries) as a group-visibility f...

5.3CVSS4.8AI score0.00533EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2024/02/19 4:31 p.m.117 views

CVE-2024-25979

CVE-2024-25979 affects Moodle where the vulnerability stems from improper handling of URL parameters in the forum search feature, allowing parameters beyond those intended to be accepted. The root cause is unsecured/insufficient validation of user-supplied URL query parameters, which can lead to ...

5.3CVSS5.5AI score0.00586EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2024/02/19 4:31 p.m.136 views

CVE-2024-25978

CVE-2024-25978 : Moodle is affected by a denial-of-service risk due to insufficient file size checks in the file picker’s unzip functionality. The available connected documents confirm the vulnerability and its impact but do not provide concrete technical details such as affected versions or exac...

7.5CVSS7.2AI score0.00944EPSS
SaveExploits0References4Affected Software1
Prion
Prion
added 2024/02/19 1:15 p.m.37 views

Sql injection

pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There must be a second placeholder for a strin...

7.5CVSS8.6AI score0.0481EPSS
SaveExploits0References3
CVE
CVE
added 2024/02/19 12:58 p.m.605 views

CVE-2024-1597

CVE-2024-1597 affects the PostgreSQL JDBC Driver (libpgjava) used with pgjdbc. The vulnerability exists when PreferQueryMode=SIMPLE is enabled (not the default); an attacker can inject SQL to alter queries. Affected versions include before 42.7.2, and older 42.6.1, 42.5.5, 42.4.4, 42.3.9, and 42....

10CVSS9.8AI score0.0481EPSS
SaveExploits0References9Affected Software1
Prion
Prion
added 2024/02/19 12:15 p.m.20 views

Default credentials

Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants...

3.6CVSS7.1AI score0.00392EPSS
SaveExploits5References1
Prion
Prion
added 2024/02/19 12:15 p.m.24 views

Default credentials

Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password...

3.6CVSS7.2AI score0.00151EPSS
SaveExploits0References1
Prion
Prion
added 2024/02/19 9:15 a.m.39 views

Code injection

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue...

1.9CVSS7.1AI score0.00898EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2024/02/19 8:33 a.m.499 views

CVE-2024-25710

CVE-2024-25710 describes a Loop with Unreachable Exit Condition (Infinite Loop) in Apache Commons Compress, affecting versions 1.3 through 1.25.0. The issue is identified as a vulnerability in the compression library, with impact details indicating high severity in some advisories and a 5.5–8.1 C...

8.1CVSS6.8AI score0.00441EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2024/02/19 8:31 a.m.514 views

CVE-2024-26308

CVE-2024-26308 affects Apache Commons Compress: Allocation of Resources Without Limits or Throttling. The IBM bulletin lists the vulnerability as present in Apache Commons Compress 1.21 through 1.25.x and fixes it in 1.26. Impact is resource exhaustion/denial of service with a base score of 5.5 (...

5.5CVSS6.8AI score0.00898EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2024/02/19 6:08 a.m.40 views

CVE-2022-4094

Technical details for CVE-2022-4094 are not publicly available in the provided documents; no affected products, impact, or remediation are described. Monitor for updates.

7.3AI score
SaveExploits0
Rows per page
Query Builder