CVSS: 5.5EPSS: 0%CPEs: 57EXPL: 0CVE-2014-0009
https://notcve.org/view.php?id=CVE-2014-0009
20 Jan 2014 — course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups capability requirement for outside-group users in a SEPARATEGROUPS configuration, which allows remote authenticated users to perform "login as" actions via a direct request. course/loginas.php en Moodle hasta 2.2.11, 2.3.x antes de 2.3.11, 2.4.x antes de 2.4.8, 2.5.x antes de 2.5.4 y 2.6.x antes de 2.6.1 no fuerza el reuiisto moodle... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42643 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 0%CPEs: 59EXPL: 0CVE-2014-0010
https://notcve.org/view.php?id=CVE-2014-0010
20 Jan 2014 — Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 allow remote attackers to hijack the authentication of administrators for requests that delete (1) categories or (2) fields. Múltiples vulnerabilidades de CSRF en user/profile/index.php en Moodle hasta la versión 2.2.11, 2.3.x anterior a 2.3.11, 2.4.x anterior a la versión 2.4.8, 2.5.x anterior a 2.5.4, y 2.6.x ante... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-42883 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 118EXPL: 1CVE-2013-4523
https://notcve.org/view.php?id=CVE-2013-4523
26 Nov 2013 — Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message. Vulnerabilidad de XSS en message/lib.php en Moodle hasta la versión 2.2.11, 2.3.x anterior a la versión 2.3.10, 2.4.x anterior a 2.4.7, y 2.5.x anterior a la versión 2.5.3 permite a usuarios remotos autenticados inyectar script web o HTML arbitrario a través de un m... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41941 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 118EXPL: 1CVE-2013-4524
https://notcve.org/view.php?id=CVE-2013-4524
26 Nov 2013 — Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path. Vulnerabilidad de recorrido de directorio en repository/filesystem/lib.php de Moodle hasta la versión 2.2.11, 2.3.x anterior a la 2.3.10, 2.4.x anterior a la versión 2.4.7, y 2.5.x anterior a 2.5.3 permite a usuarios remotos autenticados leer archivos arbitrarios a t... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41807 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.4EPSS: 0%CPEs: 118EXPL: 1CVE-2013-4525
https://notcve.org/view.php?id=CVE-2013-4525
26 Nov 2013 — Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question. Vulnerabilidad de XSS en mod/quiz/report/responses/responses_table.php en Moodle hasta la versión 2.2.11, 2.3.x anterior a 2.3.10, 2.4.x anterior a la versión 2.4.7, y 2.5.x anterior a 2.5.3 permite a usuarios remo... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-41820 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 118EXPL: 1CVE-2013-4522
https://notcve.org/view.php?id=CVE-2013-4522
26 Nov 2013 — lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server. lib/filelib.php en Moodle hasta la versión 2.2.11, 2.3.x anterior a 2.3.10, 2.4.x anterior a la versión 2.4.7, y 2.5.x anterior a 2.5.3 no envía las cabeceras HTTP "Cache-Control: private", lo que permite a a... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-38743 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 64%CPEs: 116EXPL: 4CVE-2013-3630 – Moodle - Remote Command Execution
https://notcve.org/view.php?id=CVE-2013-3630
30 Oct 2013 — Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor. Moodle a través de 2.5.2 permite a los administradores remotos autenticados ejecutar programas arbitrarios mediante la configuración de la ruta aspell y luego desencadenar una operación de corrección ortográfica en el editor TinyMCE. • https://packetstorm.news/files/id/123853 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 29EXPL: 0CVE-2013-4313
https://notcve.org/view.php?id=CVE-2013-4313
16 Sep 2013 — Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string. Moodle desde 2.2.11, 2.3.x anterior a 2.3.9, 2.4.x anterior a 2.4.6, y 2.5.x anterior a 2.5.2 no previene el uso de caracteres "\0" en cadenas de busqueda lo que podría permitir a atacantes remotos dirigir un ataque de inyección SQL contra Microsoft... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40676 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 6%CPEs: 18EXPL: 3CVE-2013-4341 – Moodle 2.3.8/2.4.5 - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-4341
16 Sep 2013 — Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed. Múltiples vulnerabilidades de XSS en Moodle de la versión 2.2.11, 2.3.x anterior a 2.3.9, 2.4.x anterior a 2.4.6, y 2.5.x anterior a 2.5.2, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de un enlace al blog dentro de... • https://packetstorm.news/files/id/164479 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2013-5674
https://notcve.org/view.php?id=CVE-2013-5674
16 Sep 2013 — badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter. badges/external.php en Moodle 2.5.x anteriores a 2.5.2 no maneja adecuadamente un objeto obtenido deserializando una descripción de badge externo, lo que permite a un atacante remoto realizar ataques de in... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40924 • CWE-94: Improper Control of Generation of Code ('Code Injection') •