CVSS: 7.5EPSS: 0%CPEs: 27EXPL: 0CVE-2012-0794
https://notcve.org/view.php?id=CVE-2012-0794
17 Jul 2012 — The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's source code within the open-source software distribution. La función rc4encrypt en lib/moodlelib.php en Moodle v1.9.x antes de v1.9.16, v2.0.x antes de v2.0.7, v2.1.x antes de v2.1.4 y v2.2.x antes de v2.2.1 utiliza un... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=98456628a24bba25d336860d38a45b5a4e3895da • CWE-255: Credentials Management Errors •
CVSS: 5.8EPSS: 0%CPEs: 17EXPL: 0CVE-2011-4294
https://notcve.org/view.php?id=CVE-2011-4294
16 Jul 2012 — The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors. La funcionalidad de mensajes de error en Moodle v1.9.x anterior a v1.9.13, v2.0.x anterior a v2.0.4, v2.1.1 y v2.1.x no garantiza que un enlace de continuidad se refiera a una dirección http o https pa... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f9f666c902cb30ef6f519353f38c45a29fdf4a6 • CWE-20: Improper Input Validation •
CVSS: 6.4EPSS: 0%CPEs: 5EXPL: 0CVE-2011-4297
https://notcve.org/view.php?id=CVE-2011-4297
16 Jul 2012 — comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity. comment/lib.php en Moodle v2.0.x anterior a v2.0.4 y v2.1.x anterior a v2.1.1 no restringe adecuadamente las capacidades de comentarios, lo que permite a atacantes remotos para escribir un comentario, aprovechando el papel de la huésped y el funcionamiento de una actividad de p... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=9da3c2efadcc5f56cb8adc19c67ed16be35780f3 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 0CVE-2011-4295
https://notcve.org/view.php?id=CVE-2011-4295
16 Jul 2012 — The moodle_enrol_external:role_assign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment. El moodle_enrol_external:role_assign function in enrol/externallib.php en Moodle v2.0.x anterior a v2.0.4 y v2.1.x anterior a v2.1.1 no tiene una comprobación de autorización, permite a usuarios remotos autenticados obtener privilegios mediante una asignación de... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=d20f655d59cd486fd9b3a26ad353af13daafd1d3 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.2EPSS: 0%CPEs: 5EXPL: 0CVE-2011-4293
https://notcve.org/view.php?id=CVE-2011-4293
16 Jul 2012 — The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets (CSS) and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified vectors. La implementación tema en Moodle v2.0.x antes de v2.0.4 y v2.1.x antes de v2.1.1 dispara duplicados de almacenamiento en caché de las Hojas de Estilo en Cascada (CSS) y el contenido de JavaScript, lo que p... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e1c2a211f259821910be2cba23679d4176fb00a3 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2011-4296
https://notcve.org/view.php?id=CVE-2011-4296
16 Jul 2012 — lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role. lib/db/access.php en Moodle v2.0.x anterior a v2.0.4 y v2.1.x anterior a v2.1.1 asigna funciones incorrectas para el rol course-creator, permite a usuarios remotos autenticados para modificar los filtros del curso mediante el aprovechamiento de este papel. • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=88d823c1f491a3c74f67bbf74306a8d1109dee02 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 19EXPL: 0CVE-2011-4301
https://notcve.org/view.php?id=CVE-2011-4301
11 Jul 2012 — The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields. La clase MoodleQuickForm en la biblioteca de formularios en lib/formslib.php en Moodle v1.9.x antes de v1.9.14, v2.0.x antes de v2.0.5 y v2.1.x antes de v2.1.2 no reconoce las operaciones setConstant de Forms A... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=f1f70bd4dde6cd1ea4bdb8ab28fa3d36a53b89d8 •
CVSS: 7.5EPSS: 0%CPEs: 19EXPL: 0CVE-2011-4302
https://notcve.org/view.php?id=CVE-2011-4302
11 Jul 2012 — mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a crafted certificate. mnet/xmlrpc/client.php en MNET en Moodle v1.9.x antes de v1.9.14, v2.0.x antes de v2.0.5, v2.1.2 antes de v2.1.x, no procesa correctamente el valor de retorno de la función openssl_verify, lo que permite a atacantes remotos evitar la validación a través ... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=54941685e3e86ec085641dcb7ebb1f96f06735b2 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 0CVE-2011-4308
https://notcve.org/view.php?id=CVE-2011-4308
11 Jul 2012 — mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors. mod/forum/user.php en Moodle v1.9.x antes de v1.9.14, v2.0.x antes de v2.0.5 y v2.1.x antes de v2.1.2 permite descubrir los nombres de otros usuarios a usuarios remotos autenticados a través de vectores no especificados. • http://git.moodle.org/gw?p=moodle.git&a=search&s=MDL-28615 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2011-4309
https://notcve.org/view.php?id=CVE-2011-4309
11 Jul 2012 — Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL. Moodle v2.0.x antes de v2.0.5 y v2.1.x antes de v2.1.2 permite a atacantes remotos eludir restricciones de acceso y realizar búsquedas globales, aprovechandose del rol de invitado y hacer una petición directa a una dirección URL. • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=5eb1cec34f013fdcb559b66bc401f2845ce0bbb7 • CWE-264: Permissions, Privileges, and Access Controls •