PT-2024-17990 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.12 GitHub Enterprise Server version 3.11.5 GitHub Enterprise Server version 3.10.7 GitHub Enterprise Server version 3.9.10 GitHub Enterprise Server version 3.8.15 Description: A command injection...

PT-2024-17967 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.12 Description: A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the...

GitHub Enterprise Server Command Injection Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from the presence of...

GitHub Enterprise Server Command Injection Vulnerability

GitHub Enterprise Server is a U.S. GitHub open source application. It provides a platform for setting up your own GitHub instance as a virtual appliance, thus providing a scalable, easy-to-manage platform. A security vulnerability exists in GitHub Enterprise Server that stems from the presence of...

Starbox < 3.5.0 - Contributor+ Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks PoC http://132" onmouseover='alert1'...

CVE-2024-1250

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with managegroupaccesstokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation...

Privilege escalation

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with managegroupaccesstokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation...

CVE-2024-1250 Privilege Chaining in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with managegroupaccesstokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation...

CVE-2024-1250 Privilege Chaining in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with managegroupaccesstokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation...

Server side request forgery (ssrf)

The Popup Builder WordPress plugin before 4.2.6 does not validate a parameter before making a request to it, which could allow users with the administrator role to perform SSRF attack in Multisite WordPress configurations...

Cross site scripting

The MapPress Maps for WordPress plugin before 2.88.15 does not sanitize and escape the map title when outputting it back in the admin dashboard, allowing Contributors and above roles to perform Stored Cross-Site Scripting attacks...

Moodle Improper Access Control vulnerability

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent...

GHSA-5P2X-8427-9FGP Moodle Improper Access Control vulnerability

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent...

CVE-2024-1439 Inadequate access control vulnerability in Moodle

Inadequate access control in Moodle LMS. This vulnerability could allow a local user with a student role to create arbitrary events intended for users with higher roles. It could also allow the attacker to add events to the calendar of all users without their prior consent...

Cross Site Scripting (XSS)

concrete5/concrete5 is vulnerable to Cross Site Scripting XSS. The vulnerability due to insufficient santization of the Role Name field within roleslist.php, allowing an attacker with admin privileges to inject malicious code into the field resulting in stored Cross Site Scripting...

PT-2024-2834 · Moodle · Moodle Lms

Name of the Vulnerable Software and Affected Versions: Moodle LMS affected versions not specified Description: The issue is related to inadequate access control in the Moodle Learning Management System. This could allow a user with a student role to create arbitrary events intended for users with...

PT-2024-5021 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.8 through 16.8.2 Description: The issue is related to insecure privilege management in GitLab EE. When a user is assigned a custom role with the manage group access tokens permission, they may be able to create group...

Concrete CMS vulnerable to stored XSS via the Role Name field

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...

GHSA-Q25H-JCH8-GFRP Concrete CMS vulnerable to stored XSS via the Role Name field

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...

Input validation

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...