Security-Blog
September 2025
Following 9 security issues have been resolved:
0045633: Test & Assessment: Stored XSS in Question Pool
0045635: WOPI: Open Redirect
0045738: Certificate: Unauthenticated Remote Code Execution
0045744: Test & Assessment: Unsafe operation during import
0045745: Certificate: Unsanitized SVG Files in Import
0045752: Test & Assessment: Authenticated RCE über unsichere Deserialisierung
0045776: Rating: Missing CSRF Token in Rating request
0045777: Data Collection: Open/Unvalidated Redirect in DataCollections
0045801: Test & Assessment: Fixes Wrong Access Right Check and Route From Test to Question
Following 9 security issues have been resolved:
0045633: Test & Assessment: Stored XSS in Question Pool
0045635: WOPI: Open Redirect
0045738: Certificate: Unauthenticated Remote Code Execution
0045744: Test & Assessment: Unsafe operation during import
0045745: Certificate: Unsanitized SVG Files in Import
0045752: Test & Assessment: Authenticated RCE über unsichere Deserialisierung
0045776: Rating: Missing CSRF Token in Rating request
0045777: Data Collection: Open/Unvalidated Redirect in DataCollections
0045801: Test & Assessment: Fixes Wrong Access Right Check and Route From Test to Question
Following 7 security issues have been resolved:
0045633: Test & Assessment: Stored XSS in Question Pool
0045738: Certificate: Unauthenticated Remote Code Execution
0045744: Test & Assessment: Unsafe operation during import
0045745: Certificate: Unsanitized SVG Files in Import
0045752: Test & Assessment: Authenticated RCE über unsichere Deserialisierung
0045776: Rating: Missing CSRF Token in Rating request
0045801: Test & Assessment: Fixes Wrong Access Right Check and Route From Test to Question
August 2025
Following 2 security issues have been resolved:
0045628: [UICore] UICore: Improper validation of CSRF tokens
0045642: [Logging] Logging: Plaintext Passwords in Error Logs
Following 2 security issues have been resolved:
0045628: [UICore] UICore: Improper validation of CSRF tokens
0045642: [Logging] Logging: Plaintext Passwords in Error Logs