Page 23 of 227 results (0.208 seconds)

CVSS: 8.1EPSS: 0%CPEs: 27EXPL: 0

CVE-2012-0795 – Debian Security Advisory 2421-1

https://notcve.org/view.php?id=CVE-2012-0795

01 Mar 2012 — Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address. Moodle v1.9.x anterior a v1.9.16, v2.0.x anterior a v2.0.7, v2.1.x anterior a v2.1.4, v2.2.1 y v2.2.x no valida la configuración del correo electrónico, permitiendo a usuarios remotos autenticados para tener una el impacto no especificado a través de una dirección diseñada. Several se... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-13572 • CWE-20: Improper Input Validation •

CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 0

CVE-2012-0796 – Debian Security Advisory 2421-1

https://notcve.org/view.php?id=CVE-2012-0796

01 Mar 2012 — class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header. class.phpmailer.php en la biblioteca PHPMailer, como los usados ??en Moodle v1.9.x antes de v1.9.16, v2.0.x antes de v2.0.7, v2.1.x antes de v2.1.4, y v2.2.x antes de v2.2.1 y otros productos, permite a usuario... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0

CVE-2011-4584 – Debian Security Advisory 2421-1

https://notcve.org/view.php?id=CVE-2011-4584

01 Mar 2012 — The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site. La funcionalidad de autenticación MNET en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 permite hacerse pasar por otras cuentas de usuario a usuarios remotos autenticados m... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=10df8657c1c138c0d0ab1d4796c552fcec0c299b • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0

CVE-2011-4586 – Debian Security Advisory 2421-1

https://notcve.org/view.php?id=CVE-2011-4586

01 Mar 2012 — CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Una vulnerabilidad de inyección CRLF en calendar/set.php en el subsistema de Calendario en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes v2.1.3 que permite a atacantes remotos inyectar cabeceras HTTP de su elecció... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=581e8dba387f090d89382115fd850d8b44351526 •

CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0

CVE-2011-4587 – Debian Security Advisory 2421-1

https://notcve.org/view.php?id=CVE-2011-4587

01 Mar 2012 — lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords. lib/moodlelib.php en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 no maneja adecuadamente ciertos valores de cero en la política de contraseñas, lo que hace que s... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e079e82c087becf06d902089d14f3f76686bde19 • CWE-255: Credentials Management Errors •

CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 0

CVE-2011-4308 – Debian Security Advisory 2421-1

https://notcve.org/view.php?id=CVE-2011-4308

01 Mar 2012 — mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors. mod/forum/user.php en Moodle v1.9.x antes de v1.9.14, v2.0.x antes de v2.0.5 y v2.1.x antes de v2.1.2 permite descubrir los nombres de otros usuarios a usuarios remotos autenticados a través de vectores no especificados. Several security issues have been fixed in Moodle, a course management system for online learning. • http://git.moodle.org/gw?p=moodle.git&a=search&s=MDL-28615 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.1EPSS: 0%CPEs: 24EXPL: 1

CVE-2011-4203

https://notcve.org/view.php?id=CVE-2011-4203

22 Dec 2011 — CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable. Vulnerabilidad de inyección en CRLF en ficheros calendar/set.php en el componente Calendar en Moodle v1.9.x anteriores a v1.9.15, v2.0.x anteriores a v2.0.6, v2.1.x anteriores a v2.1.3, y v2.2 permiten a atacantes rem... • http://penturalabs.wordpress.com/2011/12/13/advisory-crlf-injection-vulnerability-in-moodle • CWE-94: Improper Control of Generation of Code ('Code Injection') •