PHP: уязвимости стека · Страница 131

Moodle: can create global glossary without being admin

A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: matrix user/power level management not always working as expected with suspended users

A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.

• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: authorization headers preserved between "emulated redirects"

A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: lack of access control when using external methods for quiz overrides

A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.

• Обновитесь до 4.4.2

Moodle: user information visibility control issues in gradebook reports

A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: admin presets export tool includes some secrets that should not be exported

A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Exported files stored in default (`public`) filesystem if not reconfigured in filament

Filament is a collection of full-stack components for accelerated Laravel development. All Filament features that interact with storage use the `default_filesystem_disk` config option. This allows the user to easily swap their storage driver to something production-ready like `s3` when deploying their app, without having to touch multiple configuration options and potentially forgetting about some. The default disk is set to `public` when you first install Filament, since this allows users to quickly get started developing with a functional disk that allows features such as file upload previews locally without the need to set up an S3 disk wi

• Обновитесь до 3.2.123

PHPExcel XXE Vulnerability

PHPExcel XXE Vulnerability

• Обновитесь до 1.8.1

Moodle: lfi vulnerability when restoring malformed block backups

A flaw was found in moodle. A local file may include risks when restoring block backups.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: idor in feedback non-respondents report allows messaging arbitrary site users

A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users returned by the report.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: site administration sql injection via xmldb editor

A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: csrf risk in feedback non-respondents report

The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerability.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: idor in badges allows deletion of arbitrary badges

A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: cache poisoning via injection into storage

To address a cache poisoning risk in Moodle, additional validation for local storage was required.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: arbitrary file read risk through pdftex

A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is available, such as those with TeX Live installed.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

Moodle: remote code execution via calculated question types

A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.

• Обновитесь до 4.1.12
• Обновитесь до 4.2.9
• Обновитесь до 4.3.6
• Обновитесь до 4.4.2

CVE-2024-51434

Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.

Ability to change environment from query in symfony/runtime

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by the kernel when handling the request. As of versions 5.4.46, 6.4.14, and 7.1.7 the `SymfonyRuntime` now ignores the `argv` values for non-SAPI PHP runtimes. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• Обновитесь до 5.4.4+dfsg-1ubuntu8+esm1
• Обновитесь до 5.4.46
• Обновитесь до 5.4.53+dfsg-0+deb12u1
• Обновитесь до 6.4.14
• Обновитесь до 6.4.14+dfsg-1
• Обновитесь до 6.4.41+dfsg-0+deb13u1
• Обновитесь до 6.4.5+dfsg-3ubuntu3+esm1
• Обновитесь до 7.1.7

Security::login does not take into account custom user_checker in symfony/security-bundle

symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` defined on a firewall is not called when Login Programmaticaly with the `Security::login` method, leading to unwanted login. As of versions 6.4.10, 7.0.10 and 7.1.3 the `Security::login` method now ensure to call the configured `user_checker`. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• Обновитесь до 6.4.10
• Обновитесь до 6.4.10+dfsg-1
• Обновитесь до 6.4.5+dfsg-3ubuntu3+esm1
• Обновитесь до 7.0.10
• Обновитесь до 7.1.3

Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client

symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, some internal information is still leaking during host resolution, which leads to possible IP/port enumeration. As of versions 5.4.46, 6.4.14, and 7.1.7 the `NoPrivateNetworkHttpClient` now filters blocked IPs earlier to prevent such leaks. All users are advised to upgrade. There are no known workarounds for this vulnerability.

• Обновитесь до 5.4.23+dfsg-1+deb12u3
• Обновитесь до 5.4.4+dfsg-1ubuntu8+esm1
• Обновитесь до 5.4.47
• Обновитесь до 6.4.15
• Обновитесь до 6.4.15+dfsg-1
• Обновитесь до 6.4.5+dfsg-3ubuntu3+esm1
• Обновитесь до 7.1.8