CVSS: 4.3EPSS: 2%CPEs: 27EXPL: 2CVE-2009-1171 – Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure
https://notcve.org/view.php?id=CVE-2009-1171
The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file. El filtro TeX en Moodle v1.6 anteriores a v1.6.9+, v1.7 anteriores a v1.7.7+, v1.8 anteriores a v1.8.9, y v1.9 anteriores a v1.9.5 permite a atacantes con la intervención del usuario leer ficheros de su elección mediante un comando "input" en secuencia con "$$", provocando que LaTeX incluya el contenido del fichero. • https://www.exploit-db.com/exploits/8297 http://cvs.moodle.org/moodle/filter/tex/filter.php?r1=1.18.4.4&r2=1.18.4.5 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html http://secunia.com/advisories/34517 http://secunia.com/advisories/34557 http://secunia.com/advisories/34600 http://secunia.com/advisories/35570 http://tracker.moodle.org/browse/MDL-18552 http://www.debian.org/security/2009/dsa-1761 http://www.securityfocus.com/archive/1/5 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2008-6125
https://notcve.org/view.php?id=CVE-2008-6125
Unspecified vulnerability in the user editing interface in Moodle 1.5.x, 1.6 before 1.6.6, and 1.7 before 1.7.3 allows remote authenticated users to gain privileges via unknown vectors. Vulnerabilidad no especificada en el interface de edición de usuario en Moodel v1.5.x, v1.6 anteriores a v1.6.6, y v1.7 anteriores a v1.7.3 que permite a los usuarios remotos autenticados obtener privilegios a través de vectores desconocidos. • http://moodle.org/mod/forum/discuss.php?d=87971 http://www.debian.org/security/2008/dsa-1691 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2008-6124
https://notcve.org/view.php?id=CVE-2008-6124
SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt. Vulnerabilidad de inyección SQL en la función hotpot_delete_selected_attempts en report.php en el módulo the HotPot en Moodle v1.6 anteriores a 1.6.7, v1.7 anteriores a v1.7.5, v1.8 anteriores v1.8.6, y v1.9 anteriores a v1.9.2 permite a los atacantes ejecutar arbitrariamente comandos SQL a través de un intento seleccionado manipulado. • http://cvs.moodle.org/moodle/mod/hotpot/report.php?r1=1.8.6.1&r2=1.8.6.2 http://moodle.org/mod/forum/discuss.php?d=101402 http://www.debian.org/security/2008/dsa-1691 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 25EXPL: 0CVE-2009-0500
https://notcve.org/view.php?id=CVE-2009-0500
Cross-site scripting (XSS) vulnerability in course/lib.php in Moodle 1.6 before 1.6.9, 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to inject arbitrary web script or HTML via crafted log table information that is not properly handled when it is displayed in a log report. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el archivo course/lib.php en Moodle v1.6 anteriores a la v1.6.9, v1.7 anteriores a v1.7.7, v1.8 anteriores a v1.8.8, y v1.9 anteriores a v1.9.4, que permite a los atacantes remotos inyectar arbitrariamente una secuencia de comandos web o HTML a través de una tabla de información log manipulada que no está manejada adecuadamente cuando es mostrada en un informe log. • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://moodle.org/security http://secunia.com/advisories/33955 http://secunia.com/advisories/34418 http://www.debian.org/security/2009/dsa-1724 http://www.openwall.com/lists/oss-security/2009/02/04/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 40EXPL: 0CVE-2008-5432
https://notcve.org/view.php?id=CVE-2008-5432
Cross-site scripting (XSS) vulnerability in Moodle before 1.6.8, 1.7 before 1.7.6, 1.8 before 1.8.7, and 1.9 before 1.9.3 allows remote attackers to inject arbitrary web script or HTML via a Wiki page name (aka page title). Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Moodle antes de 1.6.8, 1.7 antes de 1.7.6, 1.8 antes de 1.8.7, y 1.9 despues de 1.9.3 permite a atacantes remotos inyectar secuencias de comando web o HTML de su elección a través de un nombre de página Wiki (alias título de página). • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html http://moodle.org/mod/forum/discuss.php?d=108590 http://secunia.com/advisories/33079 http://secunia.com/advisories/33822 http://www.debian.org/security/2008/dsa-1691 http://www.openwall.com/lists/oss-security/2008/12/09/4 http://www.securityfocus.com/bid/32714 http://www.vupen.com/english/advisories/2008/3405 https://exchange.xforce.ibmcloud.com/vulnerabilities/47193 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •