13092 matches found
GHSA-QWM8-VGM6-F86P Script security sandbox bypass in Jenkins Email Extension Plugin
A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java,...
GHSA-6XQG-F34F-5FJX Moodle vulnerable to Cross-site Scripting
Multiple cross-site scripting XSS vulnerabilities in the course-tags functionality in tag/coursetagsmore.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 sort or 2 show parameter...
GHSA-62WV-866C-RH86 Moodle does not properly restrict comment capabilities
comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity...
GHSA-9XP2-5FR9-7MWM Moodle vulnerable to SQL injection
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to 1 the addtolog function in mod/wiki/view.php in the wiki module, or 2 "data validation in some forms elements" related to...
GHSA-M3XP-4HF3-QFPP Moodle allows remote attackers to obtain sensitive information
Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml...
GHSA-X5HJ-47VV-53P8 YUI Cross-site Scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML...
GHSA-47CW-WHH9-J2FQ Moodle allows attacks to obtain sensitive information
lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message...
GHSA-VQ76-5GHR-9P4V Openstack Manila Persistent XSS in Metadata field
Cross-site scripting XSS vulnerability in the "Shares" overview in Openstack Manila before 2.5.1 allows remote authenticated users to inject arbitrary web script or HTML via the Metadata field in the "Create Share" form...
GHSA-9H6P-92JQ-888X vulnerabilities
Vulnerabilities for packages: cassandra-reaper...
Exposure of Sensitive Information in eventsource
When fetching an url with a link to an external site Redirect, the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."...
Improper Validation of Array Index
The html package aka x/net/html through 2018-09-25 in Go mishandles , leading to a "panic: runtime error" index out of range in insertionModeStack.pop in node.go, called from inHeadIM, during an html.Parse call...
DLA-3005-1 lrzip - security update
Bulletin has no description...
Arbitrary Code Execution
XMP Toolkit is vulnerable to arbitrary code injection. The vulnerability exists due to a memory corruption vulnerability which allows an attacker to inject and execute malicious code...
Arbitrary Code Execution
XMP Toolkit is vulnerable to arbitrary code execution. The vulnerability exists because of a memory corruption which allows an attacker to inject and execute arbitrary codes...
ALBA-2022:2119 libsemanage bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...
RLSA-2022:1861 Moderate: maven:3.5 security update
Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fixes: apache-httpclient: incorrect handling of malformed authority...
Moderate: qt5-qtbase security update
Qt is a software toolkit for developing applications. The qt5-base packages contain base tools for string, xml, and network handling in Qt. Security Fixes: qt: out-of-bounds write in QOutlineMapper::convertPath called from QRasterPaintEngine::fill and QPaintEngineEx::stroke CVE-2021-38593 For mor...
ALBA-2022:2025 nfs-utils bug fix and enhancement update
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...