CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2012-2361
https://notcve.org/view.php?id=CVE-2012-2361
21 Jul 2012 — Cross-site scripting (XSS) vulnerability in admin/webservice/forms.php in the web services implementation in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the name field (aka the service name) to admin/webservice/service.php. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en admin/webservice/forms.php en la implementación del servicio Web en Moodle v2.0.x anteiores a v2.0.9, v... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31694 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 18EXPL: 0CVE-2012-2364
https://notcve.org/view.php?id=CVE-2012-2364
21 Jul 2012 — Cross-site scripting (XSS) vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html rendering during a "download all" action. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en lib/filelib.php en Moodle v2.0.x antgeriores a v2.0.9, v2.1.x anteriores v2.1.6, y v2.2.x anteriores a v2.2.3 ... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=ce4126c7a9e07dd0514f7ac297b5e60cad0b8d20 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 18EXPL: 0CVE-2012-2365
https://notcve.org/view.php?id=CVE-2012-2365
21 Jul 2012 — Cross-site scripting (XSS) vulnerability in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the idnumber field to cohort/edit.php. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Moodle v2.0.x anteriores a v2.0.9, v2.1.x anteiores a v2.1.6, y 2.2.x anteriores a v2.2.3 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del campo idnumber sobre cohor... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-31691 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 35EXPL: 0CVE-2012-2367
https://notcve.org/view.php?id=CVE-2012-2367
21 Jul 2012 — Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/calendar:manageownentries capability requirement and add a calendar entry via a New Entry action. Moodle v1.9.x anteriores a v1.9.18, 2.0.x anteriores a v2.0.9, v2.1.x anteriores a v2.1.6, y v2.2.x anteriores a v2.2.3 permite a usuarios remotos autenticados a evitar los requisitos moodle/calendar:manageownentries y añadir una entrada a calendario a través de una a... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-18335 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2011-4581
https://notcve.org/view.php?id=CVE-2011-4581
20 Jul 2012 — mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wiki creator by visiting the history and deletion user interface. mod/wiki/pagelib.php en Moodle v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 permite a usuarios remotos autenticados descubrir el nombre de usuario de un creador de wiki visitando la interfaz de historial y de eliminación de usuarios. • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=140af2a0f0a4598bf568b9ae182cb81eb583edeb • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2011-4583
https://notcve.org/view.php?id=CVE-2011-4583
20 Jul 2012 — Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1) disabled services and (2) users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens. Moodle v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 muestra las fichas de servicios web asociadas con (1) los servicios deshabilitados y (2) los usuarios que ya no tienen autorización, lo que permite tener un impacto no especificado a usuarios remotos... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28670&sr=1 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2011-4584
https://notcve.org/view.php?id=CVE-2011-4584
20 Jul 2012 — The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site. La funcionalidad de autenticación MNET en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 permite hacerse pasar por otras cuentas de usuario a usuarios remotos autenticados m... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=10df8657c1c138c0d0ab1d4796c552fcec0c299b • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2011-4586
https://notcve.org/view.php?id=CVE-2011-4586
20 Jul 2012 — CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Una vulnerabilidad de inyección CRLF en calendar/set.php en el subsistema de Calendario en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes v2.1.3 que permite a atacantes remotos inyectar cabeceras HTTP de su elecció... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=581e8dba387f090d89382115fd850d8b44351526 •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2011-4587
https://notcve.org/view.php?id=CVE-2011-4587
20 Jul 2012 — lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords. lib/moodlelib.php en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 no maneja adecuadamente ciertos valores de cero en la política de contraseñas, lo que hace que s... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e079e82c087becf06d902089d14f3f76686bde19 • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2011-4589
https://notcve.org/view.php?id=CVE-2011-4589
20 Jul 2012 — backup/moodle2/restore_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action. backup/moodle2/restore_stepslib.php en Moodle v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 no comprueba el privilegio moodle/course:changeidnumber durante la manipulación de números de identificación del curso, lo que permite sobrescri... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29591 • CWE-264: Permissions, Privileges, and Access Controls •