CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3851
https://notcve.org/view.php?id=CVE-2019-3851
26 Mar 2019 — A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page. Se ha descubierto una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3 y la 3.5.5. Había un enlace al inicio del sitio en la capa segura del tema de Boost, lo que significa que los estudiantes podrían navegar fuera de la página. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3851 •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-3850
https://notcve.org/view.php?id=CVE-2019-3850
26 Mar 2019 — A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5, 3.4.8 y 3.1.17. Los enlaces con comentarios de envío de tareas se abrirían directamente (en la misma... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3850 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3849
https://notcve.org/view.php?id=CVE-2019-3849
26 Mar 2019 — A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los usuarios podrían autoasignarse un rol escalado en los cursos o el contenido al que se accede mediante LTI modificando la petición al sitio LTI del editor. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849 • CWE-269: Improper Privilege Management CWE-285: Improper Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3848
https://notcve.org/view.php?id=CVE-2019-3848
26 Mar 2019 — A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.) Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los permisos no se comprobaban correctamente antes de cargar información de eventos en ... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848 • CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3809
https://notcve.org/view.php?id=CVE-2019-3809
25 Mar 2019 — A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page. Se ha encontrado un error en Moodle, en versiones 3.1 a 3.1.15 y versiones anteriores sin soporte. La funcionalidad ‘‘mybackpack’’ ha permitido establecer la URL de las insignias cuando debería estar restringida la U... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64222 • CWE-352: Cross-Site Request Forgery (CSRF) CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.4EPSS: 0%CPEs: 5EXPL: 0CVE-2019-3808
https://notcve.org/view.php?id=CVE-2019-3808
25 Mar 2019 — A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default. Se ha encontrado un error en Moodle, en versiones 3.4 a 3.6.1, 3.3 a 3.5.3, 3.2 a 3.4.6 y 3.1 a 3.1.15, así como en versiones anteriores sin... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-64395 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 2%CPEs: 4EXPL: 4CVE-2019-3810 – Moodle 3.6.1 - Persistent Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2019-3810
25 Mar 2019 — A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted. Se ha encontrado un error en Moodle, desde la versión 3.6 hasta la 3.6.1, de la 3.5 a la 3.5.3, de la 3.4 a la 3.4.6 y desde la 3.1 hasta la 3.1.15, así como en versiones anteriores sin soporte. La ... • https://packetstorm.news/files/id/162399 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6970
https://notcve.org/view.php?id=CVE-2019-6970
18 Mar 2019 — Moodle 3.5.x before 3.5.4 allows SSRF. Moodle, en versiones 3.5.x anteriores a la 3.5.4 permite Server-Side Request Forgery (SSRF). • https://www.excellium-services.com/cert-xlm-advisory/cve-2019-6970 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1CVE-2018-16854
https://notcve.org/view.php?id=CVE-2018-16854
26 Nov 2018 — A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15. Se ha encontrado un error en Moodle en las siguientes versiones: desde la 3.5 hasta la 3.5.2, desde la 3.4 hasta la 3.4.5, desde la 3.3 hasta la 3.3.8 y desde la 3.1 hasta la 3.1.14 y anteriores. El formulario de inicio de sesión no es protegido por un token ... • https://github.com/danielthatcher/moodle-login-csrf • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2018-14631
https://notcve.org/view.php?id=CVE-2018-14631
17 Sep 2018 — moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter. moodle en versiones anteriores a la 3.5.2, 3.4.5 y 3.3.8 es vulnerable al filtrado insuficiente del parámetro GET de búsqueda de blogs y boost th... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-62857 • CWE-20: Improper Input Validation CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •