Advisories

Listing reported advisories sorted by their report date.

Moodle has insufficient access control
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2

2024-11-12 21:25:11
Moodle has user information visibility control issues in gradebook reports
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6 · >= 4.2.0, < 4.2.9 · < 4.1.12

2024-11-12 21:23:41
Moodle admin presets export tool includes some secrets that should not be exported
GitHub

moodle/moodle

>= 4.4.0, < 4.4.2 · >= 4.3.0, < 4.3.6 · >= 4.2.0, < 4.2.9 · < 4.1.12

2024-11-12 21:22:52
Orchid Platform has Method Exposure Vulnerability in Modals
GitHub

orchid/platform

>= 8.0, < 14.43.0

2024-11-12 19:56:55
Twig has unguarded calls to `__isset()` and to array-accesses when the sandbox is enabled
GitHub

twig/twig

>= 3.12.0, < 3.14.1 · >= 1.0.0, < 3.11.2 · >= 3.12, < 3.14.1 · < 3.11.2

2024-11-12 19:43:03
Twig has unguarded calls to `__toString()` when nesting an object into an array
GitHub

twig/twig

>= 3.12.0, < 3.14.1 · >= 1.0.0, < 3.11.2 · >= 3.12, < 3.14.1 · < 3.11.2

2024-11-12 19:42:26
Moodle LFI vulnerability when restoring malformed block backups
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:30:38
Moodle's IDOR in Feedback non-respondents report allows messaging arbitrary site users
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:28:38
Moodle vulnerable to site administration SQL injection via XMLDB editor
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:28:03
Moodle has CSRF risk in Feedback non-respondents report
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:27:28
Moodle's IDOR in badges allows deletion of arbitrary badges
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:26:58
Moodle vulnerable to cache poisoning via injection into storage
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:21:18
Moodle has arbitrary file read risk through pdfTeX
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:19:25
Moodle Remote Code Execution vulnerability
GitHub

moodle/moodle

>= 4.4.0-beta, < 4.4.2 · >= 4.3.0-beta, < 4.3.6 · >= 4.2.0-beta, < 4.2.9 · < 4.1.12

2024-11-07 18:15:26
PHPExcel XXE Vulnerability
GitHub

phpoffice/phpexcel

< 1.8.1

2024-11-07 17:29:00
Filament has exported files stored in default (`public`) filesystem if not reconfigured
GitHub

filament/actions

>= 3.2.0, < 3.2.123

2024-11-07 16:14:16
UnoPim Cross-site Scripting vulnerability
GitHub

unopim/unopim

< 0.1.4

2024-11-06 20:21:57
Symfony vulnerable to command execution hijack on Windows with Process class
GitHub

symfony/process

>= 6.0.0, < 6.4.14 · >= 7.0.0, < 7.1.7 · < 5.4.46

2024-11-06 15:22:57
Symfony vulnerable to open redirect via browser-sanitized URLs
GitHub

symfony/http-foundation

>= 6.0.0, < 6.4.14 · >= 7.0.0, < 7.1.7 · < 5.4.46

2024-11-06 15:22:12
Symfony has an incorrect response from Validator when input ends with `\n`
GitHub

symfony/symfony

>= 6.0.0, < 6.4.11 · >= 7.0.0, < 7.1.4 · < 5.4.43

2024-11-06 15:21:09
Symfony's `Security::login` does not take into account custom `user_checker`
GitHub

symfony/security-bundle

>= 7.0.0, < 7.0.10 · >= 6.2.0, < 6.4.10 · >= 7.1.0, < 7.1.3

2024-11-06 15:13:43
Symfony allows changing the environment through a query
GitHub

symfony/runtime

>= 6.0.0, < 6.4.14 · >= 5.3.0, < 5.4.46 · >= 7.0.0, < 7.1.7

2024-11-06 15:11:11
Unguarded calls to __toString() when nesting an object into an array
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
Unguarded calls to __isset() and to array-accesses when the sandbox is enabled
FriendsOfPHP

twig/twig

>=3.12.0, <3.14.1 · >=3.0.0, <3.11.2 · >=2.0.0, <3.0.0 · >=1.0.0, <2.0.0

2024-11-06 08:00:00
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
GitHub

maximebf/debugbar

< 1.19.0

2024-11-05 20:16:56
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/http-foundation

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/process

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/runtime

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-50340: Ability to change environment from query
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0

2024-11-05 08:00:00
CVE-2024-50345: Open redirect via browser-sanitized URLs
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
CVE-2024-51736: Command execution hijack on Windows with Process class
FriendsOfPHP

symfony/symfony

>=6.4.0, <6.4.14 · >=5.4.0, <5.4.46 · >=7.1.0, <7.1.7 · >=7.0.0, <7.1.0 · >=6.3.0, <6.4.0 · >=6.2.0, <6.3.0 · >=6.1.0, <6.2.0 · >=6.0.0, <6.1.0 · >=5.3.0, <5.4.0 · >=5.2.0, <5.3.0 · >=5.1.0, <5.2.0 · >=5.0.0, <5.1.0 · >=4.0.0, <5.0.0 · >=3.0.0, <4.0.0 · >=2.0.0, <3.0.0

2024-11-05 08:00:00
Cross-site scripting vulnerability in includes/actions/InfoAction.php
GitHub

mediawiki/core

>= 1.22.0, < 1.22.6 · < 1.21.9

2024-11-01 23:10:24
img_auth.php may leak private extension images into the public cache
GitHub

mediawiki/core

>= 1.34.0, < 1.34.2 · >= 1.32.0, < 1.33.4 · < 1.31.8

2024-11-01 23:09:03
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
GitHub

mediawiki/core

>= 1.39.0, < 1.39.3 · >= 1.38.0, < 1.38.6 · < 1.35.10

2024-11-01 22:02:39
raspap-webgui vulnerable to denial of service
GitHub

billz/raspap-webgui

< 3.1.0

2024-11-01 21:45:51
Laravel Reverb Missing API Signature Verification
GitHub

laravel/reverb

< 1.4.0

2024-10-31 18:03:12
YesWiki Uses a Broken or Risky Cryptographic Algorithm
GitHub

yeswiki/yeswiki

<= 4.4.4

2024-10-31 17:12:38
ThinkPHP deserialization vulnerability
GitHub

topthink/thinkphp

>= 6.1.3, <= 8.0.4

2024-10-30 22:08:19
PEAR::Archive_Tar Directory Traversal vulnerability
GitHub

pear/archive_tar

>= 1.2, < 1.3.2

2024-10-30 18:09:28
MediaWiki Denial of Service vulnerability
GitHub

mediawiki/core

>= 1.36.0, < 1.39.5 · < 1.35.12 · = 1.40.0

2024-10-30 18:06:32
Drupal has open redirect vulnerability in the Overlay module
GitHub

drupal/drupal

>= 7.0, < 7.24

2024-10-30 17:57:21
phpBB 3.0.7 allows remote attackers to bypass intended access restrictions
GitHub

phpbb/phpbb

> 3.0.6, < 3.0.7-PL1

2024-10-30 17:54:19
phpBB vulnerability related to use of "forum id" in circumstances related to a "global announcement."
GitHub

phpbb/phpbb

< 3.0.5

2024-10-30 17:52:01
phpBB vulnerable to sensitive information disclosure
GitHub

phpbb/phpbb

< 3.0.4

2024-10-30 17:14:55
phpBB's Smiley Pack acp_icons.php main pack vulnerable to cross site scripting
GitHub

phpbb/phpbb

< 3.3.11

2024-10-30 16:42:40
HTML Purifier allows remote attackers to obtain sensitive information
GitHub

ezyang/htmlpurifier

<= 4.2.0

2024-10-29 21:31:44
HTML Purifier Cross-site Scripting vulnerability
GitHub

ezyang/htmlpurifier

< 2.0.1

2024-10-29 21:20:56
Cross site scripting in ameos_tarteaucitron
GitHub

ameos/ameos_tarteaucitron

< 1.2.23

2024-10-28 18:46:13
Funadmin Cross-site Scripting vulnerability
GitHub

funadmin/funadmin

<= 5.0.2

2024-10-28 14:38:36
Logic flaw in Funadmin
GitHub

funadmin/funadmin

<= 5.0.2

2024-10-25 21:48:55
« Previous Next »

Showing 501 to 550 of 5933 results

1 2 ... 8 9 10 11 12 13 14 ... 118 119