Page 38 of 193 results (0.018 seconds)

CVSS: 6.4EPSS: 0%CPEs: 16EXPL: 0

CVE-2009-0499

https://notcve.org/view.php?id=CVE-2009-0499

Cross-site request forgery (CSRF) vulnerability in the forum code in Moodle 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to delete unauthorized forum posts via a link or IMG tag to post.php. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el código del foro de Moodle v1.7 anterior a v1.7.7, v1.8 anterior a v1.8.8 y v1.9 anterior a v1.9.4; permite a atacantes remotos eliminar los mensajes del foro no autorizados a través de un enlace o etiqueta IMG en post.php. • http://cvs.moodle.org/moodle/mod/forum/post.php?r1=1.154.2.14&r2=1.154.2.15 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://moodle.org/security http://secunia.com/advisories/34418 http://www.openwall.com/lists/oss-security/2009/02/04/1 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 4.3EPSS: 0%CPEs: 40EXPL: 0

CVE-2008-5432

https://notcve.org/view.php?id=CVE-2008-5432

Cross-site scripting (XSS) vulnerability in Moodle before 1.6.8, 1.7 before 1.7.6, 1.8 before 1.8.7, and 1.9 before 1.9.3 allows remote attackers to inject arbitrary web script or HTML via a Wiki page name (aka page title). Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Moodle antes de 1.6.8, 1.7 antes de 1.7.6, 1.8 antes de 1.8.7, y 1.9 despues de 1.9.3 permite a atacantes remotos inyectar secuencias de comando web o HTML de su elección a través de un nombre de página Wiki (alias título de página). • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html http://moodle.org/mod/forum/discuss.php?d=108590 http://secunia.com/advisories/33079 http://secunia.com/advisories/33822 http://www.debian.org/security/2008/dsa-1691 http://www.openwall.com/lists/oss-security/2008/12/09/4 http://www.securityfocus.com/bid/32714 http://www.vupen.com/english/advisories/2008/3405 https://exchange.xforce.ibmcloud.com/vulnerabilities/47193 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2008-3325

https://notcve.org/view.php?id=CVE-2008-3325

Cross-site request forgery (CSRF) vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page. Vulnerabilidad de falsificación de petición en sitios cruzados (CSFR) en Moodle 1.6.x versiones anteriores a la 1.6.7 y 1.7.x versiones anteriores a la 1.7.5, permite a atacantes remotos modificar el perfil de la configuración y obtener privilegios como otro usuario a través de un enlace o etiqueta IMG de la página de edición del perfil de usuario. • http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html http://moodle.org/mod/forum/discuss.php?d=101405 http://secunia.com/advisories/31196 http://secunia.com/advisories/31339 http://www.debian.org/security/2008/dsa-1691 http://www.procheckup.com/Vulnerability_PR08-16.php http://www.securityfocus.com/archive/1/494658/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/43964 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 2.6EPSS: 1%CPEs: 11EXPL: 2

CVE-2008-3326

https://notcve.org/view.php?id=CVE-2008-3326

Cross-site scripting (XSS) vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter (blog entry title). Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en blog/edit.php en Moodle 1.6.x anterior a 1.6.7 y 1.7.x anterior a 1.7.5, permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección mediante el parámetro etitle (título de la entrada del blog - blog entry title). • http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00001.html http://moodle.org/mod/forum/discuss.php?d=101401 http://secunia.com/advisories/31196 http://secunia.com/advisories/31339 http://www.debian.org/security/2008/dsa-1691 http://www.procheckup.com/Vulnerability_PR08-13.php http://www.securityfocus.com/archive/1/494656/100/0/threaded http://www.securityfocus.com/bid/30348 https://exchange.xforce.ibmcloud.com/vulnerabilities/43961 https://www.exploit-db.com/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 43EXPL: 1

CVE-2008-1502

https://notcve.org/view.php?id=CVE-2008-1502

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols. La función _bad_protocol_once en el archivo phpgwapi/inc/class.kses.inc.php en KSES, como es usado en eGroupWare versiones anteriores a 1.4.003, Moodle versiones anteriores a 1.8.5 y otros productos, permite a los atacantes remotos omitir el filtrado de HTML y conducir ataques de tipo cross-site scripting (XSS) por medio de una cadena que contiene protocolos URL especialmente diseñados. • http://docs.moodle.org/en/Release_Notes#Moodle_1.8.5 http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html http://secunia.com/advisories/29491 http://secunia.com/advisories/30073 http://secunia.com/advisories/30986 http://secunia.com/advisories/31017 http://secunia.com/advisories/31018 http://secunia.com/advisories/31167 http://secunia.com/advisories/32400 http://secunia.com/advisories/32446 http://www.debian.org/security/2008/dsa-1691 http://www& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •