CVSS: 7.5EPSS: 7%CPEs: 27EXPL: 2CVE-2009-1171 – Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure
https://notcve.org/view.php?id=CVE-2009-1171
30 Mar 2009 — The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file. El filtro TeX en Moodle v1.6 anteriores a v1.6.9+, v1.7 anteriores a v1.7.7+, v1.8 anteriores a v1.8.9, y v1.9 anteriores a v1.9.5 permite a atacantes con la intervención del usuario leer ficheros de su elección mediante un comando "input" en secuencia con "... • https://www.exploit-db.com/exploits/8297 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2008-6124
https://notcve.org/view.php?id=CVE-2008-6124
13 Feb 2009 — SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt. Vulnerabilidad de inyección SQL en la función hotpot_delete_selected_attempts en report.php en el módulo the HotPot en Moodle v1.6 anteriores a 1.6.7, v1.7 anteriores a v1.7.5, v1.8 anteriores v1.8.6, y v1.9 anteriores a v1.9.... • http://cvs.moodle.org/moodle/mod/hotpot/report.php?r1=1.8.6.1&r2=1.8.6.2 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 0%CPEs: 16EXPL: 0CVE-2009-0499
https://notcve.org/view.php?id=CVE-2009-0499
10 Feb 2009 — Cross-site request forgery (CSRF) vulnerability in the forum code in Moodle 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to delete unauthorized forum posts via a link or IMG tag to post.php. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el código del foro de Moodle v1.7 anterior a v1.7.7, v1.8 anterior a v1.8.8 y v1.9 anterior a v1.9.4; permite a atacantes remotos eliminar los mensajes del foro no autorizados a través de un enlace o etiqueta IMG... • http://cvs.moodle.org/moodle/mod/forum/post.php?r1=1.154.2.14&r2=1.154.2.15 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 25EXPL: 0CVE-2009-0500
https://notcve.org/view.php?id=CVE-2009-0500
10 Feb 2009 — Cross-site scripting (XSS) vulnerability in course/lib.php in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via crafted log table information that is not properly handled when it is displayed in a log report. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el archivo course/lib.php en Moodle v1.6 anteriores a la v1.6.9, v1.7 anteriores a v1.7.7, v1.8 anteriores a v1.8.8, y v1.... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2009-0502
https://notcve.org/view.php?id=CVE-2009-0502
10 Feb 2009 — Cross-site scripting (XSS) vulnerability in blocks/html/block_html.php in Snoopy 1.2.3, as used in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4, allows remote attackers to inject arbitrary web script or HTML via an HTML block, which is not properly handled when the "Login as" feature is used to visit a MyMoodle or Blog page. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en blocks/html/block_html.php en Snoopy v1.2.3, como la utilizada en ... • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2008-5432
https://notcve.org/view.php?id=CVE-2008-5432
11 Dec 2008 — Cross-site scripting (XSS) vulnerability in Moodle before 1.6.8, 1.7 before 1.7.6, 1.8 before 1.8.7, and 1.9 before 1.9.3 allows remote attackers to inject arbitrary web script or HTML via a Wiki page name (aka page title). Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Moodle antes de 1.6.8, 1.7 antes de 1.7.6, 1.8 antes de 1.8.7, y 1.9 despues de 1.9.3 permite a atacantes remotos inyectar secuencias de comando web o HTML de su elección a través de un nombre de página Wik... • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 1%CPEs: 43EXPL: 1CVE-2008-1502
https://notcve.org/view.php?id=CVE-2008-1502
25 Mar 2008 — The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols. La función _bad_protocol_once en el archivo phpgwapi/inc/class.kses.inc.php en KSES, como es usado en eGroupWare versiones anteriores a 1.4.003, Moodle versiones anteriores a 1.8.5 y otros productos, permite a los ... • http://docs.moodle.org/en/Release_Notes#Moodle_1.8.5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2008-0123 – Moodle 1.8.3 - 'install.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-0123
12 Jan 2008 — Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete. Vulnerabilidad de cruce de directorios (XSS) en install.php de Moodle 1.8.3, y posiblemente otras versiones anteriores a la 1.8.4. Permite que atacantes remotos inyecten, a su elección, códigos web o HTML a traves del parámetro dbname. NOTA: ... • https://www.exploit-db.com/exploits/31020 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •