Page 36 of 463 results (0.005 seconds)

CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-3273

https://notcve.org/view.php?id=CVE-2015-3273

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization. mod/forum/post.php en Moodle 2.9.x en versiones anteriores a 2.9.1 no considera la capacidad mod/forum:canposttomygroups antes de autorizar una acción "Enviar una copia a todos los grupos", lo que permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso aprovechando autorizaciones por grupo. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50220 http://openwall.com/lists/oss-security/2015/07/13/2 http://www.securitytracker.com/id/1032877 https://moodle.org/mod/forum/discuss.php?d=316663 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0

CVE-2015-5272

https://notcve.org/view.php?id=CVE-2015-5272

The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants." El módulo Forum en Moodle 2.7.x en versiones anteriores a 2.7.10 permite a usuarios remotos autenticados publicar en grupos arbitrarios aprovechando el rol de profesor, según lo demostrado por una publicación directa a "todos los participantes". • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50576 http://www.openwall.com/lists/oss-security/2015/09/21/1 http://www.securitytracker.com/id/1033619 https://moodle.org/mod/forum/discuss.php?d=320288 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0

CVE-2015-5341

https://notcve.org/view.php?id=CVE-2015-5341

mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors. mod_scorm en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.11, 2.8.x en versiones anteriores a 2.8.9 y 2.9.x en versiones anteriores a 2.9.3 no maneja adecuadamente la disponibilidad de fechas, lo que permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y leer contenidos SCORM a través de vectores no especificados. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50837 https://moodle.org/mod/forum/discuss.php?d=323236 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 24EXPL: 0

CVE-2015-5335

https://notcve.org/view.php?id=CVE-2015-5335

Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL. Vulnerabilidad de CSRF en admin/registration/register.php en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.11, 2.8.x en versiones anteriores a 2.8.9 y 2.9.x en versiones anteriores a 2.9.3 permite a atacantes remotos secuestrar la autenticación de administradores en peticiones que envían estadísticas a una URL de hub arbitraria. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51091 https://moodle.org/mod/forum/discuss.php?d=323230 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 7.1EPSS: 0%CPEs: 12EXPL: 0

CVE-2015-5332

https://notcve.org/view.php?id=CVE-2015-5332

Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature. Atto en Moodle 2.8.x en versiones anteriores a 2.8.9 y 2.9.x en versiones anteriores a 2.9.3 permite a atacantes remotos causar una denegación de servicio (consumo de disco) aprovechando el rol invitado e introduciendo borradores con la funcionalidad editor-autosave. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51000 https://moodle.org/mod/forum/discuss.php?d=323229 • CWE-399: Resource Management Errors •