CVSS: 6.1EPSS: 0%CPEs: 22EXPL: 0CVE-2010-1618
https://notcve.org/view.php?id=CVE-2010-1618
29 Apr 2010 — Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la biblioteca de cliente phpCAS anterior a v1.1.0, utilizado en Moodle v1.8.x anterior a v1.8.12 y v1.9.x anterior a v1.9.8, permite a atacantes remoto... • http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2010-1619
https://notcve.org/view.php?id=CVE-2010-1619
29 Apr 2010 — Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la función fix_non_standard_entities en la biblioteca de limpieza de texto KSES HTML (weblib.php), utilizado en Moodle v1.8.x antes de v1.8.12... • http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4297
https://notcve.org/view.php?id=CVE-2009-4297
16 Dec 2009 — Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 permite a atacantes remotos secuestrar la autenticación de victimas inespecíficas a través de vectores desconocidos. • http://docs.moodle.org/en/Moodle_1.8.11_release_notes • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.3EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4298
https://notcve.org/view.php?id=CVE-2009-4298
16 Dec 2009 — The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors. El modulo LAMS (mod/lams) para en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 almacena los campos (1) nombre de usuarios, (2) nombre, y (3) apellidos dentro de la tabla de usuario, lo que permite a los atacantes obtener la información de la cuenta de us... • http://docs.moodle.org/en/Moodle_1.8.11_release_notes • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4300
https://notcve.org/view.php?id=CVE-2009-4300
16 Dec 2009 — Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for passwords in the user table, even when the cached hashes are not used by the plugin, which might make it easier for attackers to obtain credentials via unspecified vectors. Múltiples plugins de autenticación sin especificar en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 almacenan los hash MD5 para las contraseñas en la tabla de usuario, incluso cuando los hashes que se cachea... • http://docs.moodle.org/en/Moodle_1.8.11_release_notes • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4301
https://notcve.org/view.php?id=CVE-2009-4301
16 Dec 2009 — mnet/lib.php in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, when MNET services are enabled, does not properly check permissions, which allows remote authenticated servers to execute arbitrary MNET functions. mnet/lib.php en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7, cuando los servicios MNET están activados, no chequea adecuadamente los permisos, lo que permite a servidores remotos autenticados ejecutar funciones MNET arbitrarias. • http://cvs.moodle.org/moodle/mnet/lib.php?r1=1.16.2.10&r2=1.16.2.11 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 1%CPEs: 15EXPL: 0CVE-2009-4304
https://notcve.org/view.php?id=CVE-2009-4304
16 Dec 2009 — Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks. Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 no utiliza variación aleatorio de contraseñas en config.php, lo que hace mas facil para los atacantes dirigir un ataque de fuerza bruta contra la contraseña. • http://docs.moodle.org/en/Moodle_1.8.11_release_notes • CWE-255: Credentials Management Errors •
CVSS: 6.8EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4299
https://notcve.org/view.php?id=CVE-2009-4299
16 Dec 2009 — mod/glossary/showentry.php in the Glossary module for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not properly perform access control, which allows attackers to read unauthorized Glossary entries via unknown vectors. mod/glossary/showentry.php en el modulo Glossary en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 no gestiona adecuadamente el acceso, lo que permite a atacantes leer entradas de "Glossary" sin autorizacion a traves de vectores desconocidos. • http://docs.moodle.org/en/Moodle_1.8.11_release_notes • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4302
https://notcve.org/view.php?id=CVE-2009-4302
16 Dec 2009 — login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and allows remote attackers to obtain these credentials by sniffing. login/index_form.html en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 enlaza a una pagina inicial en un puerto HTTP incluso cuando la pagina es servida desde un puerto HTTPS, lo qu... • http://docs.moodle.org/en/Moodle_1.8.11_release_notes • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4303
https://notcve.org/view.php?id=CVE-2009-4303
16 Dec 2009 — Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information. Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 almacena (1) los hashes de las contraseñas y (2) "secretos" sin especificar en ficheros de copias de seguridad, lo que permitiría a atacantes obtener información sensible. • http://docs.moodle.org/en/Moodle_1.8.11_release_notes • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •