CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2021-43558
https://notcve.org/view.php?id=CVE-2021-43558
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk. Se encontró un fallo en Moodle en versiones 3.11 a 3.11.3, 3.10 a 3.10.7, 3.9 a 3.9.10 y versiones anteriores no soportadas. Un parámetro de URL en la herramienta de administración del sitio filetype requería un saneamiento adicional para evitar un riesgo de un ataque de tipo XSS reflejado • https://bugzilla.redhat.com/show_bug.cgi?id=2021515 https://moodle.org/mod/forum/discuss.php?d=429097 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-3943
https://notcve.org/view.php?id=CVE-2021-3943
A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A remote code execution risk when restoring backup files was identified. Se ha encontrado un fallo en Moodle en versiones 3.11 a 3.11.3, 3.10 a 3.10.7, 3.9 a 3.9.10 y versiones anteriores no soportadas. Se ha identificado un riesgo de ejecución de código remota cuando se restauran archivos de copia de seguridad • https://bugzilla.redhat.com/show_bug.cgi?id=2021963 https://moodle.org/mod/forum/discuss.php?d=429095 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 12%CPEs: 4EXPL: 3CVE-2020-14321 – Moodle Teacher Enrollment Privilege Escalation / Remote Code Execution
https://notcve.org/view.php?id=CVE-2020-14321
In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course. En Moodle versiones anteriores a 3.9.1, 3.8.4, 3.7.7 y 3.5.13, los profesores de un curso podían asignarse a sí mismos el rol de administrador dentro de ese curso. • https://github.com/HoangKien1020/CVE-2020-14321 https://github.com/lanzt/CVE-2020-14321 https://github.com/f0ns1/CVE-2020-14321-modified-exploit https://moodle.org/mod/forum/discuss.php?d=407393 • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 5%CPEs: 1EXPL: 3CVE-2021-21809 – Moodle SpellChecker Path Authenticated Remote Command Execution
https://notcve.org/view.php?id=CVE-2021-21809
A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities. Se presenta una vulnerabilidad de ejecución de comandos en el plugin default legacy spellchecker en Moodle versión 3.10. Una serie de peticiones HTTP especialmente diseñadas pueden conllevar a una ejecución de comandos. • https://github.com/anldori/CVE-2021-21809 http://packetstormsecurity.com/files/164481/Moodle-SpellChecker-Path-Authenticated-Remote-Command-Execution.html https://talosintelligence.com/vulnerability_reports/TALOS-2021-1277 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2021-32244
https://notcve.org/view.php?id=CVE-2021-32244
Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en Moodle versión 3.10.3, permite a atacantes remotos ejecutar un script web o HTML arbitrario por medio del campo "Description" • https://github.com/langkexiansheng/Images/blob/master/moodle_xss.gif • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •