Page 34 of 175 results (0.003 seconds)

CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 0

CVE-2013-4939

https://notcve.org/view.php?id=CVE-2013-4939

Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. Vulnerabilidad de XSS en el io.swf en el componente IO Utility en Yahoo! YUI 3.0.0 a la 3.9.1, utilizado en Moodle hasta la 2.1.10, 2.2.x anterior a 2.2.11, 2.3.x anterior a 2.3.8, 2.4.x anterior a 2.4.5, 2.5.x anterior a 2.5.1, y otros productos, permite a atacantes remotos inyectar secuencias de comandos web y HTML a través de una cadena en una URL. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678 http://yuilibrary.com/support/20130515-vulnerability https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c%40%3Cissues.zookeeper.apache.org%3E https://lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e%40%3Cdev.zookeeper.apache.org%3E https://moodle.org/mod/forum/discuss.php?d=232496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.0EPSS: 0%CPEs: 36EXPL: 0

CVE-2013-2242

https://notcve.org/view.php?id=CVE-2013-2242

mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server. mod/chat/gui_sockets/index.php en Moodle desde 2.1.10, 2.2.x anterior a 2.2.11, 2.3.x anterior a 2.3.8, 2.4.x anterior a 2.4.5, y 2.5.x anterior a 2.5.1, no considera la capacidad mod/chat:chat antes de la autorización del chat en daemon-mode, lo que permite a usuarios autenticados remotamente evitar las restricciones de acceso establecidas mediante una sesión HTTP al servidor de chat. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39628 https://moodle.org/mod/forum/discuss.php?d=232498 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.0EPSS: 0%CPEs: 36EXPL: 0

CVE-2013-2243

https://notcve.org/view.php?id=CVE-2013-2243

mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document. mod/lesson/pagetypes/matching.php en Moodle 2.2.x anterior a 2.2.11, 2.3.x anterior a 2.3.8, 2.4.x anterior a 2.4.5, y 2.5.x anterior a 2.5.1, permite a usuarios autenticados remotamente obtener información de respuesta sensible mediante la lectura del código HTML de un documento. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39546 https://moodle.org/mod/forum/discuss.php?d=232500 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 4.3EPSS: 0%CPEs: 6EXPL: 0

CVE-2013-2244

https://notcve.org/view.php?id=CVE-2013-2244

Multiple cross-site scripting (XSS) vulnerabilities in lib/conditionlib.php in Moodle 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the conditional access rule value of a user field. Multiples vulnerabilidades XSS en lib/conditionlib.php en Moodle 2.4.x anterior a 2.4.5, y 2.5.x anterior a 2.5.1 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del valor de la regla condicional de acceso de un campo de usuario. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37516 https://moodle.org/mod/forum/discuss.php?d=232501 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.0EPSS: 0%CPEs: 36EXPL: 0

CVE-2013-2245

https://notcve.org/view.php?id=CVE-2013-2245

rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for impersonation, which allows remote authenticated users to obtain sensitive block information by reading an RSS feed. rss/file.php en Moodle a la 2.1.10, 2.2.x anterior a 2.2.11, 2.3.x anterior a 2.3.8, 2.4.x anterior a 2.4.5, y 2.5.x anterior a 2.5.1 no implementa adecuadamente el uso de los tokens RSS para suplantación, lo que permite a usuarios autenticados remotamente obtener un bloque de información sensible a través del feed RSS. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37818 https://moodle.org/mod/forum/discuss.php?d=232502 • CWE-287: Improper Authentication •