625 matches found
CVE-2023-5546
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...
Cross site scripting
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...
UBUNTU-CVE-2023-5546
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...
Cross site scripting
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...
UBUNTU-CVE-2023-5544
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk...
CVE-2023-5546
CVE-2023-5546 concerns Moodle: stored cross-site scripting via quiz grading report, triggered by displaying user-id numbers without adequate sanitization. The connected sources consistently describe this as a Moodle-related vulnerability where the risk is a stored XSS, arising from insufficient i...
CVE-2023-5546 Moodle: stored xss in quiz grading report via user id number
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...
CVE-2023-5546 Moodle: stored xss in quiz grading report via user id number
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk...
CVE-2023-5544
CVE-2023-5544 relates to a stored XSS and potential IDOR risk in Moodle Wiki comments due to insufficient sanitization and access restrictions. Connected sources (OSV/GHSA advisories and Nessus notes) corroborate a Wiki comments stored XSS/IDOR issue, with no explicit affected versions or patch d...
Cross site scripting
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
CVE-2023-43797 BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobby
BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wait to enter the meeting due to inserting unsanitized messages to the element using unsafe innerHTML. Text sanitizing was added for lobby...
PT-2023-29868 · Unknown · Rs-Stellar-Strkey
Name of the Vulnerable Software and Affected Versions: rs-stellar-strkey versions prior to 0.0.8 Description: A panic vulnerability occurs when a specially crafted payload is used, due to an issue with the inner payload len variable. This variable should not be above 64. The vulnerability is caus...
Deserialization Of Untrusted Data
org.apache.inlong: manager-pojo is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to filterSensitive function in MySQLSinkDTO.java not properly sanitizing whitespace characters, especially the horizontal tab \t, in URL parameters, which allows these characters to bypass...
CVE-2023-41629
A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal...
Path traversal
A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal...
CVE-2023-41629
CVE-2023-41629 concerns a path traversal vulnerability in the file download feature of eSST Monitoring v2.147.1, caused by a lack of input sanitizing. The issue is documented across multiple sources in the connected set, which consistently describe a path traversal risk that could be exploited vi...