CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-10890
https://notcve.org/view.php?id=CVE-2018-10890
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories. Se ha encontrado un error en Moodle en versiones anteriores a la 3.5.1, 3.4.4, 3.3.7 y la 3.1.13. Era posible que el servicio web core_course_get_categories devolviese categorías ocultas, lo que debería omitirse al recuperar categorías de curso. • http://www.securityfocus.com/bid/104738 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890 https://moodle.org/mod/forum/discuss.php?d=373370 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10889
https://notcve.org/view.php?id=CVE-2018-10889
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester. Se ha encontrado un error en Moodle en versiones anteriores a la 3.5.1, 3.4.4 y la 3.3.7. No existe una opción para omitir los registros de las exportaciones de privacidad de datos, lo que podría contener detalles de otros usuarios que interactuaban con el solicitante. • http://www.securityfocus.com/bid/104733 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10889 https://moodle.org/mod/forum/discuss.php?d=373369 • CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1134
https://notcve.org/view.php?id=CVE-2018-1134
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL. Se ha descubierto un problema en Moodle 3.x. Los estudiantes que enviaban tareas y las exportaban a portfolios podían descargar cualquier archivo Moodle cambiando la URL de descarga. • http://www.securityfocus.com/bid/104307 https://moodle.org/mod/forum/discuss.php?d=371200 • CWE-269: Improper Privilege Management •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1135
https://notcve.org/view.php?id=CVE-2018-1135
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL. Se ha descubierto un problema en Moodle 3.x. Los estudiantes que publicaban en los foros y exportaban sus publicaciones a portfolios podían descargar cualquier archivo Moodle cambiando la URL de descarga. • http://www.securityfocus.com/bid/104307 https://moodle.org/mod/forum/discuss.php?d=371201 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2018-1136
https://notcve.org/view.php?id=CVE-2018-1136
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users. Se ha descubierto un problema en Moodle 3.x. Un usuario autenticado puede añadir bloques HTML que contienen scripts a su Dashboard; esto no suele suponer un problema de seguridad porque los dashboards personales solo son visibles para este usuario. • http://www.securityfocus.com/bid/104307 https://moodle.org/mod/forum/discuss.php?d=371202 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •