CVSS: 5.0EPSS: 0%CPEs: 103EXPL: 0CVE-2013-1830
https://notcve.org/view.php?id=CVE-2013-1830
user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search. user/view.php en Moodle hasta v2.1.10, v2.2.x anterior a v2.2.8, v2.3.x anterior a v2.3.5, y v2.4.x anterior a 2.4.2 no aplica el ajuste forceloginforprofiles, que permite a atacantes remotos obtener información del perfil del curso aprovechando el rol de invitado, como lo demuestra una búsqueda en Google. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37481 http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html http://openwall.com/lists/oss-security/2013/03/25/2 https://moodle.org/mod/forum/discuss.php?d=225341 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 53EXPL: 0CVE-2010-2228
https://notcve.org/view.php?id=CVE-2010-2228
Cross-site scripting (XSS) vulnerability in the MNET access-control interface in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via vectors involving extended characters in a username. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la interfase de control de acceso MNET en Moodle anteriores a v1.8.13 y v1.9.x anteriores a v1.9.9, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores que implican caracteres extendidos en el nombre de usuario. • http://docs.moodle.org/en/Moodle_1.8.13_release_notes http://docs.moodle.org/en/Moodle_1.9.9_release_notes http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043340.html http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html http://moodle.org/mod/forum/discuss.php?d=152366 http://secunia.com& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 53EXPL: 0CVE-2010-2229
https://notcve.org/view.php?id=CVE-2010-2229
Multiple cross-site scripting (XSS) vulnerabilities in blog/index.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en blog/index.php en Moodle anteriores a v1.8.13 y v1.9.x anteriores a v1.9.9, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de parámetros no especificados. • http://cvs.moodle.org/moodle/blog/lib.php?r1=1.62.2.9&r2=1.62.2.10 http://cvs.moodle.org/moodle/blog/lib.php?r1=1.80.2.20&r2=1.80.2.21 http://docs.moodle.org/en/Moodle_1.8.13_release_notes http://docs.moodle.org/en/Moodle_1.9.9_release_notes http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html http://lists.fedoraproject.org/pipermail/package-announce/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 53EXPL: 0CVE-2010-2230
https://notcve.org/view.php?id=CVE-2010-2230
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input. El filtro de limpieza de KSES en lib/weblib.php en Moodle anteriores a v1.8.13 y v1.9.x anteriores a v1.9.9 no gestiona de forma adecuada direcciones URI vbscript, lo que permite a usuarios autenticados remotos conducir un ataque ejecución de secuencias de comandos (XSS) través de una entrada HTML. • http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.812.2.114&r2=1.812.2.115 http://cvs.moodle.org/moodle/lib/weblib.php?r1=1.970.2.171&r2=1.970.2.172 http://docs.moodle.org/en/Moodle_1.8.13_release_notes http://docs.moodle.org/en/Moodle_1.9.9_release_notes http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html http://lists.fedoraproject.org/pipermail/package-an • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 53EXPL: 0CVE-2010-2231
https://notcve.org/view.php?id=CVE-2010-2231
Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en report/overview/report.php en el módulo quiz en Moodle anteriores a v1.8.13 y v1.9.x anteriores a v1.9.9, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección que borran intentos del test a través del parámetro attempid. • http://cvs.moodle.org/moodle/mod/quiz/report/overview/report.php?r1=1.98.2.50&r2=1.98.2.51 http://docs.moodle.org/en/Moodle_1.8.13_release_notes http://docs.moodle.org/en/Moodle_1.9.9_release_notes http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043285.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043291.html http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043340.html http://lists.opensuse.org/opensuse-security&# • CWE-352: Cross-Site Request Forgery (CSRF) •