An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
References
https://nvd.nist.gov/vuln/de…
An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-28948
https://github.com/go-yaml/yaml/issues/666
https://github.com/go-yaml…
Impact
There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerabil…
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
References
https://nvd.nist.gov/vuln/detail/CVE-2019-25…
Cross-site Scripting (XSS) – DOM in GitHub repository octoprint/octoprint prior to 1.8.0. The login endpoint allows for javascript injection which may lead to account takeover in a phishing scenario.
References
https://nvd.nist.gov/vuln/detail/CVE-202…
Cross-site Scripting (XSS) – Generic in GitHub repository octoprint/octoprint prior to 1.8.0. The Stream URL of octoprint application allowing a xss payload to execute.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-1432
https://github.com/octop…
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-30598
https://bugzilla.redhat.com/show_bu…
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-30596
https://bugzilla.redhat.com/show_…
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-30597
https://bugzilla.redhat.com/show_bug.cgi?id=2083585
https://moodle.org/mod/for…
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-30599
https://bugzilla.redhat.com/show_bug.cgi?id=2083610
https://moodle.org/mo…
