CVSS: 6.1EPSS: 0%CPEs: 9EXPL: 0CVE-2011-4591
https://notcve.org/view.php?id=CVE-2011-4591
20 Jul 2012 — Cross-site scripting (XSS) vulnerability in the print_object function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, when a developer debugging script is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors involving object states. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en la función print_object en lib/datalib.php en Moodle v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3, cuando se activa una secuencia de comandos de depu... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=187672608ec96659e07f2461b3b83634debd16cb • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2011-4592
https://notcve.org/view.php?id=CVE-2011-4592
20 Jul 2012 — The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to restore cron functionality. La implementación de la crontab por línea de comandos en Moodle v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 no interactua adecuadamente con el bloqueo de IPs, lo que podría permitir a atacantes remotos... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=ade30ad3c420ce035a3d68287db701b70e806b3f • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2011-4587
https://notcve.org/view.php?id=CVE-2011-4587
20 Jul 2012 — lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords. lib/moodlelib.php en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 no maneja adecuadamente ciertos valores de cero en la política de contraseñas, lo que hace que s... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e079e82c087becf06d902089d14f3f76686bde19 • CWE-255: Credentials Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 23EXPL: 0CVE-2011-4586
https://notcve.org/view.php?id=CVE-2011-4586
20 Jul 2012 — CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Una vulnerabilidad de inyección CRLF en calendar/set.php en el subsistema de Calendario en Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes v2.1.3 que permite a atacantes remotos inyectar cabeceras HTTP de su elecció... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=581e8dba387f090d89382115fd850d8b44351526 •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2011-4585
https://notcve.org/view.php?id=CVE-2011-4585
20 Jul 2012 — login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network. login/change_password.php en Moodle v1.9.x antes de v1.9.15 no utiliza HTTPS para el formulario de cambio de contraseña, incluso si la opción httpslogin está activada, lo que permite a atacantes remotos obtener credenciales espiando el tráfico de red. • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=01dd64a8c8aa95f793accea371b2392e662663c5 • CWE-16: Configuration •
CVSS: 4.3EPSS: 0%CPEs: 23EXPL: 0CVE-2011-4593
https://notcve.org/view.php?id=CVE-2011-4593
20 Jul 2012 — Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/action_redir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface. Moodle v1.9.x antes de v1.9.15, v2.0.x antes de v2.0.6 y v2.1.x antes de v2.1.3 no controla correctamente los mensajes de grupo user/action_redir, lo que permite descubrir direcciones de correo electrónico a usuarios remotos autenticados visitando la interfaz de mensajería. • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=e94113a859015a4a80b9397957b8fc4044e2951f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 0CVE-2011-4588
https://notcve.org/view.php?id=CVE-2011-4588
20 Jul 2012 — The ip_in_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request. La función ip_in_range en Mnet/lib.php en MNET en Moodle v1.9.x antes de v1.9.15 utiliza un tipo de datos incorrecto, lo que permite a atacantes remotos eludir restricciones de direcciones IP a través de una solicitud XMLRPC. • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=3ab2851d2a59721445945d0706c58092e07e861e • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 27EXPL: 0CVE-2012-0796
https://notcve.org/view.php?id=CVE-2012-0796
17 Jul 2012 — class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header. class.phpmailer.php en la biblioteca PHPMailer, como los usados ??en Moodle v1.9.x antes de v1.9.16, v2.0.x antes de v2.0.7, v2.1.x antes de v2.1.4, y v2.2.x antes de v2.2.1 y otros productos, permite a usuario... • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=62988bf0bbc73df655f51884aaf1f523928abff9 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2012-0798
https://notcve.org/view.php?id=CVE-2012-0798
17 Jul 2012 — The self-enrolment functionality in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 allows remote authenticated users to obtain the manager role by leveraging the teacher role. La funcionalidad de auto-inscripción en Moodle v2.1.x anterior a v2.1.4 y v2.2.x anterior a v2.2.1 permite a usuarios remotos autenticados obtener la función de administrador mediante el aprovechamiento de la función docente. • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29469 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 0%CPEs: 27EXPL: 0CVE-2012-0793
https://notcve.org/view.php?id=CVE-2012-0793
17 Jul 2012 — Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors. Moodle v1.9.x antes de v1.9.16, v2.0.x antes de v2.0.7, v2.1.x antes de v2.1.4, y v2.2.x antes de v2.2.1 permite a atacantes remotos ver las imágenes de perfil de las cuentas de usuario a través de vectores no especificados. • http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=90911c4ff98dc2078a3acef5ddf5a1a8f7e20ba5 • CWE-264: Permissions, Privileges, and Access Controls •