Vulnerabilities

A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authenticated remote user to bypass blocked-host restrictions. By supplying a crafted URL, an attacker can induce the server to make requests to restricted destinations, leading to Server-Side Request Forgery (SSRF).

A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure.

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database.

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X (PLC4J) allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service.<br /> <br /> In the OPC UA driver these defects are reachable before authentication: the offending data is parsed while the secure channel and session are being established, before the server&amp;#39;s identity has been bound to it. Configuring a trusted server therefore does not prevent exploitation by an attacker who can <br /> impersonate it.<br /> <br /> The individual defects are:<br /> - Length-prefixed byte strings are allocated at the size claimed on the wire before the length is checked against the data actually received (0.10.0 through 0.13.1).<br /> - Array fields in generated protocol parsers pre-allocate a list with the element count claimed on the wire, allowing a single count field to trigger a multi-gigabyte allocation. This parser is shared by all PLC4J drivers; the OPC UA driver is the verified pre-authentication path (0.10.0 through 0.13.1).<br /> - The OPC UA driver accumulates message chunks without enforcing the negotiated maximum chunk count and message size (0.12.0 through 0.13.1).<br /> - The OPC UA driver pre-allocates collections using element counts received from the server (0.10.0 through 0.13.1).<br /> - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Go implementation is covered by CVE-2026-102510 https://cveprocess.apache.org/cve5/CVE-2026-102510 .<br /> <br /> This issue affects Apache PLC4X: from 0.10.0 before 1.0.0.<br /> <br /> Users are recommended to upgrade to version 1.0.0, which fixes the issue.

Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go implementation of Apache PLC4X (PLC4Go) allow a malicious device, or an attacker able to inject network traffic, to crash or exhaust the memory of the client application,<br /> causing a denial of service.<br /> <br /> The individual defects are:<br /> - Generated parsers pre-allocate arrays with the element count claimed on the wire (0.13.0 through 0.13.1).<br /> - Transport read helpers allocate buffers of the size claimed on the wire without an upper bound.<br /> - ADS and KNXnet/IP response handling indexes into received data without checking its length, causing a panic.<br /> - ADS and EIP frame-length handling accepts, or arithmetically wraps to, a length of zero, breaking message framing.<br /> - Recursive protocol types are parsed without a nesting-depth limit. The same defect in the Java implementation is covered by CVE-2026-102509 https://cveprocess.apache.org/cve5/CVE-2026-102509 .<br /> <br /> Additionally, length and position arithmetic in generated serializers was performed in 16-bit integers. If an application forwards attacker-influenced payloads larger than 8 KB, the length field wraps, and the remainder of the payload may be interpreted by the receiving device (for example, an ADS PLC) as <br /> additional, independent protocol messages.<br /> <br /> This issue affects Apache PLC4X: from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.<br /> <br /> Users are recommended to upgrade to version 1.0.0, which fixes the issue.

Improper Verification of Source of a Communication Channel in the ADS discovery of the Go implementation of Apache PLC4X (PLC4Go) allows an attacker able to send UDP datagrams to the discovering host to redirect subsequent connections to an arbitrary, attacker-chosen address. The discovery result&amp;#39;s connection <br /> address was derived from the AmsNetId claimed in the response body rather than from the datagram&amp;#39;s actual source address. One spoofed discovery response can therefore insert an inventory entry pointing at any host, including hosts outside the local network, and an application that connects to discovered devices<br /> will open its ADS session, including any configured route credentials, to that host.<br /> <br /> Additionally, discovery listeners in both implementations can be disabled by a single malformed datagram:<br /> - In PLC4Go ADS discovery, a short version block causes a panic that ends the listener for the rest of the discovery call, so legitimate devices answering afterwards are not reported.<br /> - In PLC4J, the ADS and EtherNet/IP discoverers stop on an unhandled exception from a malformed response.<br /> - The PLC4J Modbus discoverer can be made to spin indefinitely, consuming a CPU core, by a scanned host that sends a partial response.<br /> <br /> Exploitation requires the application to invoke the discovery API, which is opt-in, and for the connection redirect, to act on the discovered items.<br /> <br /> This issue affects Apache PLC4X: PLC4Go from 0.11.0 before 1.0.0; PLC4J ADS and Modbus drivers from 0.10.0 before 1.0.0; PLC4J EtherNet/IP driver from 0.11.0 before 1.0.0. PLC4Go is consumed as the Go module github.com/apache/plc4x/plc4go; versions refer to the corresponding Apache PLC4X releases.<br /> <br /> Users are recommended to upgrade to version 1.0.0, which fixes the issue. Version 1.0.0 derives the connection address from the datagram&amp;#39;s source address and logs a warning when the claimed AmsNetId disagrees with it.

EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.

EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents.

EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files.

EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users&amp;#39; plaintext passwords through a specific API.

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user&amp;#39;s browser through phishing attacks.