CVSS: 6.4EPSS: 0%CPEs: 16EXPL: 0CVE-2009-0499
https://notcve.org/view.php?id=CVE-2009-0499
Cross-site request forgery (CSRF) vulnerability in the forum code in Moodle 1.7 before 1.7.7, 1.8 before 1.8.8, and 1.9 before 1.9.4 allows remote attackers to delete unauthorized forum posts via a link or IMG tag to post.php. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el código del foro de Moodle v1.7 anterior a v1.7.7, v1.8 anterior a v1.8.8 y v1.9 anterior a v1.9.4; permite a atacantes remotos eliminar los mensajes del foro no autorizados a través de un enlace o etiqueta IMG en post.php. • http://cvs.moodle.org/moodle/mod/forum/post.php?r1=1.154.2.14&r2=1.154.2.15 http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://moodle.org/security http://secunia.com/advisories/34418 http://www.openwall.com/lists/oss-security/2009/02/04/1 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2009-0501
https://notcve.org/view.php?id=CVE-2009-0501
Unspecified vulnerability in the Calendar export feature in Moodle 1.8 before 1.8.8 and 1.9 before 1.9.4 allows attackers to obtain sensitive information and conduct "brute force attacks on user accounts" via unknown vectors. Vulnerabilidad no especificada en la característica de exportar el Calendario (Calendar) de Moodle v1.8 anterior a v1.8.8 y v1.9 anterior a v1.9.4; permite a atacantes obtener información sensible y provocar "ataques por fuerza bruta en las cuentas de los usuarios" a través de vectores desconocidos. • http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html http://moodle.org/security http://secunia.com/advisories/34418 http://www.openwall.com/lists/oss-security/2009/02/04/1 •
CVSS: 4.3EPSS: 0%CPEs: 40EXPL: 0CVE-2008-5432
https://notcve.org/view.php?id=CVE-2008-5432
Cross-site scripting (XSS) vulnerability in Moodle before 1.6.8, 1.7 before 1.7.6, 1.8 before 1.8.7, and 1.9 before 1.9.3 allows remote attackers to inject arbitrary web script or HTML via a Wiki page name (aka page title). Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Moodle antes de 1.6.8, 1.7 antes de 1.7.6, 1.8 antes de 1.8.7, y 1.9 despues de 1.9.3 permite a atacantes remotos inyectar secuencias de comando web o HTML de su elección a través de un nombre de página Wiki (alias título de página). • http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html http://moodle.org/mod/forum/discuss.php?d=108590 http://secunia.com/advisories/33079 http://secunia.com/advisories/33822 http://www.debian.org/security/2008/dsa-1691 http://www.openwall.com/lists/oss-security/2008/12/09/4 http://www.securityfocus.com/bid/32714 http://www.vupen.com/english/advisories/2008/3405 https://exchange.xforce.ibmcloud.com/vulnerabilities/47193 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 1CVE-2008-5153
https://notcve.org/view.php?id=CVE-2008-5153
spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, or (3) /tmp/spell-check-after temporary file. spell-check-logic-cgi en Moodle v1.8.2 permite a usuarios locales sobrescribir ficheros de su elección a través de un ataque de enlace simbólico en los ficheros temporales: (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, y (3) /tmp/spell-check-after. • http://lists.debian.org/debian-devel/2008/08/msg00347.html http://secunia.com/advisories/33955 http://uvw.ru/report.sid.txt http://www.debian.org/security/2009/dsa-1724 http://www.securityfocus.com/bid/32402 https://exchange.xforce.ibmcloud.com/vulnerabilities/46708 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 4.3EPSS: 0%CPEs: 43EXPL: 1CVE-2008-1502
https://notcve.org/view.php?id=CVE-2008-1502
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols. La función _bad_protocol_once en el archivo phpgwapi/inc/class.kses.inc.php en KSES, como es usado en eGroupWare versiones anteriores a 1.4.003, Moodle versiones anteriores a 1.8.5 y otros productos, permite a los atacantes remotos omitir el filtrado de HTML y conducir ataques de tipo cross-site scripting (XSS) por medio de una cadena que contiene protocolos URL especialmente diseñados. • http://docs.moodle.org/en/Release_Notes#Moodle_1.8.5 http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00006.html http://secunia.com/advisories/29491 http://secunia.com/advisories/30073 http://secunia.com/advisories/30986 http://secunia.com/advisories/31017 http://secunia.com/advisories/31018 http://secunia.com/advisories/31167 http://secunia.com/advisories/32400 http://secunia.com/advisories/32446 http://www.debian.org/security/2008/dsa-1691 http://www& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •