Code injection

In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10...

UBUNTU-CVE-2020-25700

In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10...

CVE-2020-25700

CVE-2020-25700 affects Moodle: database module web services allowed students to add entries in groups they did not belong to. Affected versions include Moodle 3.9.0–3.9.2, 3.8.0–3.8.5, 3.7.0–3.7.8, 3.5.0–3.5.14 and earlier unsupported releases. The issue is fixed in Moodle 3.8.6, 3.7.9, 3.5.15, a...

Apache CXF Cross-Site Scripting Vulnerability (CNVD-2020-66585)

Apache CXF is the United States Apache Apache Software Foundation of an open source Web services framework. The framework supports a variety of Web services standards , a variety of front-end programming APIs. A cross-site scripting vulnerability exists in Apache CXF version 3.4.1 and all version...

Moodle Override Access Vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from the fact that some database module web services allow students to add...

Moodle SQL注入漏洞

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. Moodle suffers from a security vulnerability that stems from the fact that some database module web services allow students to add...

The vulnerability of the Apache CXF web service framework, related to connection establishment errors, allows attackers to gain unauthorized access to protected information.

The vulnerability of Apache CXF web services is related to errors during connection establishment. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Web Services component of the Oracle WebLogic Server application server allows a perpetrator to gain unauthorized access to protected information or to modify, add, or delete data.

The vulnerability of the Web Services component of the Oracle WebLogic Server application server is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information or to modify, add, or...

U.S. Dept Of Defense: https://██████ vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD

Hi @U.S. Dept Of Defense, I found a host which is running on the web services interface of Cisco ASA/FTD and it is vulnerable to CVE-2020-3187 - Unauthenticated arbitrary file deletion in Cisco ASA/FTD. An attacker could exploit this vulnerability by sending a crafted HTTP request containing...

Millions of Hotel Guests Worldwide Caught Up in Mass Data Leak

A widely used hotel reservation platform has exposed 10 million files related to guests at various hotels around the world, thanks to a misconfigured Amazon Web Services S3 bucket. The records include sensitive data, including credit-card details. Prestige Software’s “Cloud Hospitality” is used b...

Citrix Security Advisory for TCP/IP Reassembly Resource Exhaustion

Description of Problem Several vulnerabilities in TCP/IP reassembly commonly known as SegmentSmack and FragmentSmack have recently been disclosed. SegmentSmack is CVE-2018-5390 for Linux and CVE-2018-6922 for FreeBSD. FragmentSmack is CVE-2018-5391 for Linux and CVE-2018-6923 for FreeBSD. These...

CloudBees Jenkins AWS Global Configuration Plugin Access Control Error Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . An access control error...

PT-2020-16162 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: moodle versions 3.5 through 3.5.14 moodle versions 3.7 through 3.7.8 moodle versions 3.8 through 3.8.5 moodle versions 3.9 through 3.9.2 Description: In moodle, some database module web services allowed students to add entries within groups...

PT-2023-13770 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to insufficient limitations in some quiz web services, allowing students to bypass sequential navigation during a quiz attempt. Recommendations: At the moment, there is ...

PT-2020-6541 · Gsoap +1 · Gsoap +1

Name of the Vulnerable Software and Affected Versions: gSOAP version 2.8.107 Description: The issue is related to an integer overflow in the WS-Addressing plugin of the gSOAP software development environment when processing SOAP requests. This can be exploited by a remote attacker to execute...

Moderate: Red Hat Security Advisory: openwsman security update

An update for openwsman is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

ALSA-2020:4689 Moderate: openwsman security update

Openwsman is a project intended to provide an open source implementation of the Web Services Management specification WS-Management and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services...

Moderate: openwsman security update

Openwsman is a project intended to provide an open source implementation of the Web Services Management specification WS-Management and to expose system management information on the Linux operating system using the WS-Management protocol. WS-Management is based on a suite of web services...

SAP BusinessObjects Business Intelligence Platform Cross-Site Request Forgery Vulnerability

SAP BusinessObjects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP. The product has report generation, analysis, data visualization and other functions. A cross-site request forgery vulnerability exists in SAP...

ForceControl Technology ForceControl Web Service Directory Arbitrary File Download Vulnerability

Forcecontrol is a monitoring and configuration software, mainly used for data acquisition and monitoring control. An arbitrary file download vulnerability exists in the ForceControl Web Services directory, which can be exploited by attackers to obtain sensitive information...