CVSS: 8.8EPSS: 0%CPEs: 12EXPL: 0CVE-2012-6103
https://notcve.org/view.php?id=CVE-2012-6103
27 Jan 2013 — Multiple cross-site request forgery (CSRF) vulnerabilities in user/messageselect.php in the messaging system in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to hijack the authentication of arbitrary users for requests that send course messages. Multiple vulnerabilidad de falsificación de petición en sitios cruzados de user/messageselect.php en el sistema de mensajería de Moodle v2.2.x antes de v2.2.7, v2.3.x antes de v2.3.4, v2.4.1 y v2.4.x antes de permitir a... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36600 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 12EXPL: 0CVE-2012-6104
https://notcve.org/view.php?id=CVE-2012-6104
27 Jan 2013 — blog/rsslib.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allows remote attackers to obtain sensitive information from site-level blogs by leveraging the guest role and reading an RSS feed. blog/rsslib.php en Moodle v2.2.x antes de v2.2.7, v2.3.x antes de v2.3.4, v2.4.1 y antes de v2.4.x , permite a atacantes remotos obtener información sensible de los blogs a nivel de sitio, aprovechando el papel de la huésped y de la lectura un feed RSS. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36620 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 0CVE-2012-6105
https://notcve.org/view.php?id=CVE-2012-6105
27 Jan 2013 — blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by reading this feed. blog/rsslib.php en Moodle v2.1.x antes de v2.1.10, v2.2.x antes de v2.2.7, v2.3.x antes de v2.3.4, v2.4.x antes de v2.4.1 que continúa proporcionando un canal de blog RSS después de blogging se desactive , que permite a atacantes remotos obtener informa... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37467 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.4EPSS: 0%CPEs: 40EXPL: 0CVE-2012-6098
https://notcve.org/view.php?id=CVE-2012-6098
27 Jan 2013 — grade/edit/outcome/edit_form.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/grade:manage capability requirement, which allows remote authenticated users to convert custom outcomes into standard site-wide outcomes by leveraging the teacher role and using the re-editing feature. grade/edit/outcome/edit_form.php en Moodle v1.9.x a la v1.9.19, 2.1.x anterior a v2.1.10, v2.2.x anterior a v2.2.7, v2.3.x a... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-27619 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2012-6106
https://notcve.org/view.php?id=CVE-2012-6106
27 Jan 2013 — calendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x before 2.4.1 omits a capability check, which allows remote authenticated users to remove course-level calendar subscriptions by leveraging the student role and sending an iCalendar object. calendar/managesubscriptions.php en Manage Subscriptions implementation in Moodle 2.4.x antes de v2.4.1 omite una comprobacion de capacidad, que permite a usuarios remotos autenticados para eliminar a nivel de curso suscripciones a... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37106 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 18EXPL: 0CVE-2012-5471
https://notcve.org/view.php?id=CVE-2012-5471
21 Nov 2012 — The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout. Dropbox Repository File Picker en Moodle v2.1.x antes de v2.1.9, v2.2.x antes de v2.2.6, y v2.3.x antes de v2.3.3 permite a usuarios remotos autenticados acceder al Dropbox de un usuario diferente al aprovechar una estación de trabajo sin supervisión después de un cierre ... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29872 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 18EXPL: 0CVE-2012-5480
https://notcve.org/view.php?id=CVE-2012-5480
21 Nov 2012 — The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass intended restrictions on reading other participants' entries via an advanced search. El módulo Database activity en Moodle v2.1.x antes de v2.1.9, v2.2.x antes de v2.2.6, y v2.3.x antes de v2.3.3, permite a los atacantes remotos evitar las restricciones previstas en la lectura de las entradas de otros participantes a través de una búsqueda avanzada. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35558 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2012-5472
https://notcve.org/view.php?id=CVE-2012-5472
21 Nov 2012 — lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to bypass intended access restrictions via a modified value of a frozen form field. lib / formslib.php en Moodle v2.2.x antes de v2.2.6 y v2.3.x antes de v2.3.3 permite a usuarios remotos autenticados eludir restricciones de acceso previstas a través de un valor modificado de un campo de formulario congelado. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32785 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 18EXPL: 0CVE-2012-5473
https://notcve.org/view.php?id=CVE-2012-5473
21 Nov 2012 — The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to read activity entries of a different group's users via an advanced search. El módulo Database activity en Moodle v2.1.x antes de v2.1.9, v2.2.x antes de v2.2.6, y v2.3.x antes de v2.3.3, permite a los atacantes remotos evitar las restricciones previstas en la lectura de las entradas de otros usuarios del grupo a través de una búsqueda avanzada. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34448 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 0%CPEs: 18EXPL: 0CVE-2012-5479
https://notcve.org/view.php?id=CVE-2012-5479
21 Nov 2012 — The Portfolio plugin in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to upload and execute files via a modified Portfolio API callback. El complemento Portfolio en Moodle v2.1.x antes de v2.1.9, v2.2.x antes de v2.2.6, y v2.3.x antes de v2.3.3 permite a usuarios remotos autenticados cargar y ejecutar archivos a través de una devolución de llamada modificada a la API Portfolio. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33791 • CWE-264: Permissions, Privileges, and Access Controls •