CVSS: 7.5EPSS: 0%CPEs: 29EXPL: 0CVE-2013-4313
https://notcve.org/view.php?id=CVE-2013-4313
Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers to conduct SQL injection attacks against Microsoft SQL Server via a crafted string. Moodle desde 2.2.11, 2.3.x anterior a 2.3.9, 2.4.x anterior a 2.4.6, y 2.5.x anterior a 2.5.2 no previene el uso de caracteres "\0" en cadenas de busqueda lo que podría permitir a atacantes remotos dirigir un ataque de inyección SQL contra Microsoft SQL Server a través de una cadena manipulada • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40676 https://moodle.org/mod/forum/discuss.php?d=238396 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2013-5674
https://notcve.org/view.php?id=CVE-2013-5674
badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to conduct PHP object injection attacks via unspecified vectors, as demonstrated by overwriting the value of the userid parameter. badges/external.php en Moodle 2.5.x anteriores a 2.5.2 no maneja adecuadamente un objeto obtenido deserializando una descripción de badge externo, lo que permite a un atacante remoto realizar ataques de inyección de objeto en PHP a través de vectores no especificados, como fué demostrado sobreescribiendo el valor del parámetro userid. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-40924 https://moodle.org/mod/forum/discuss.php?d=238397 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 0CVE-2013-4939
https://notcve.org/view.php?id=CVE-2013-4939
Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. Vulnerabilidad de XSS en el io.swf en el componente IO Utility en Yahoo! YUI 3.0.0 a la 3.9.1, utilizado en Moodle hasta la 2.1.10, 2.2.x anterior a 2.2.11, 2.3.x anterior a 2.3.8, 2.4.x anterior a 2.4.5, 2.5.x anterior a 2.5.1, y otros productos, permite a atacantes remotos inyectar secuencias de comandos web y HTML a través de una cadena en una URL. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39678 http://yuilibrary.com/support/20130515-vulnerability https://lists.apache.org/thread.html/72837f969cdf9b63a7e7337edd069fa3b3950eea7c997cc2ff61aa0c%40%3Cissues.zookeeper.apache.org%3E https://lists.apache.org/thread.html/d8b9403dbab85a51255614949938b619bd03b1c944c76c48c6996a0e%40%3Cdev.zookeeper.apache.org%3E https://moodle.org/mod/forum/discuss.php?d=232496 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 36EXPL: 0CVE-2013-2242
https://notcve.org/view.php?id=CVE-2013-2242
mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat capability before authorizing daemon-mode chat, which allows remote authenticated users to bypass intended access restrictions via an HTTP session to a chat server. mod/chat/gui_sockets/index.php en Moodle desde 2.1.10, 2.2.x anterior a 2.2.11, 2.3.x anterior a 2.3.8, 2.4.x anterior a 2.4.5, y 2.5.x anterior a 2.5.1, no considera la capacidad mod/chat:chat antes de la autorización del chat en daemon-mode, lo que permite a usuarios autenticados remotamente evitar las restricciones de acceso establecidas mediante una sesión HTTP al servidor de chat. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39628 https://moodle.org/mod/forum/discuss.php?d=232498 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.0EPSS: 0%CPEs: 36EXPL: 0CVE-2013-2243
https://notcve.org/view.php?id=CVE-2013-2243
mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive answer information by reading the HTML source code of a document. mod/lesson/pagetypes/matching.php en Moodle 2.2.x anterior a 2.2.11, 2.3.x anterior a 2.3.8, 2.4.x anterior a 2.4.5, y 2.5.x anterior a 2.5.1, permite a usuarios autenticados remotamente obtener información de respuesta sensible mediante la lectura del código HTML de un documento. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-39546 https://moodle.org/mod/forum/discuss.php?d=232500 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •