Archive
25 January 2022
Vulnerabilities first published on this day (UTC), newest first.
114 results · Feed
-
High 8.8
Cross Site Request Forgery in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
-
Medium 4.3
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport…
-
Low 3.8
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessin…
-
Critical 9.8
SQL injection in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
-
High 8.8
Improper header sanitization in bored-agent causes escalation of privilege
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
-
Medium 6.1
Charactell - FormStorm Enterprise Account Take Over
Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in the FormStorm folder contains usernames in cleartext and an obfuscated password. Malicious user can…
-
Unscored —
Escalation of privileges vulnerability in Micro Focus in Micro Focus Operations Agent, affecting versions 12.x up to an…
-
Unscored —
A malicious crafted dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
This module provides a stream wrapper for files located in the vendor directory. Even when the vendor directory is move…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
**Update** Maintainers stepped forward, fixed the security issue, and Vocabulary Permissions Per Role is supported agai…
-
Unscored —
This module enables you to automatically scan images uploaded to the site to extract their meta data and store it in ta…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
Unscored —
Update 2022-03-01. New maintainers have volunteered for the project and created a new release which includes fixes for …
-
Unscored —
The security team is marking this project unsupported. There is a known security issue with the project that has not be…
-
High 7.5
IBM WebSphere Application Server - Liberty 17.0.0.3 through 22.0.0.1 could allow a remote authenticated attacker to con…
-
Unscored —
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not…
-
Unscored —
OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators b…
-
Unscored —
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.
-
Unscored —
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.
-
Unscored —
xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examin…
-
Medium 6.5
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NET…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…
-
High 7.8
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…
-
High 7.5
This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-…
-
High 8.8
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An…
-
High 8.8
This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NET…
-
High 7.5
SQL Injection in FileContentProvider (GHSL-2021-1007)
The Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. The Nextcloud Android app uses content providers to manage its data. Prior to version 3.18.1, the providers `FileContentProvider` and `DiskLruImageCacheFilePro…
-
Unscored —
A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nick…
-
Unscored —
In ForestBlog, as of 2021-12-28, File upload can bypass verification.
-
Critical 9.1
Authentication Bypass by Primary Weakness in adodb/adodb
Authentication Bypass by Primary Weakness in GitHub repository adodb/adodb prior to 5.20.21.
-
Critical 9.8
SQL Injection in JeecgBoot
In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
-
Medium 6.3
SSRF vulnerability (requires authentication)
Jupyter Server Proxy is a Jupyter notebook server extension to proxy web services. Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server ex…
-
Unscored —
Insufficient cleanup of passed-through device IRQs The management of IRQs associated with physical devices exposed to x…
-
Unscored —
A PV guest could DoS Xen while unmapping a grant To address XSA-380, reference counting was introduced for grant mappin…