CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-18210
https://notcve.org/view.php?id=CVE-2019-18210
11 Feb 2020 — Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Bec... • https://docs.moodle.org/38/en/Teacher_role • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10186
https://notcve.org/view.php?id=CVE-2019-10186
31 Jul 2019 — A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool. Se encontró una fallo en moodle anterior de las versiones 3.7.1, 3.6.5, 3.5.7. La herramienta de administración de carga / descarga XML no estaba utilizando un token sesskey (CSRF). • http://www.securityfocus.com/bid/109175 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10187
https://notcve.org/view.php?id=CVE-2019-10187
31 Jul 2019 — A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to. Se encontró una fallo en moodle anterior de las versiones 3.7.1, 3.6.5, 3.5.7. Los usuarios con permiso para eliminar entradas de un glosario pudieron eliminar entradas de otros glosarios a los que no tenían acceso directo. • http://www.securityfocus.com/bid/109174 • CWE-284: Improper Access Control CWE-862: Missing Authorization •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10188
https://notcve.org/view.php?id=CVE-2019-10188
31 Jul 2019 — A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz. Un defecto fue descubierto en moodle anterior a las versiones 3.7.1 ,3.6.5.7. los profesores en un grupo de preguntas podría modificar las anulaciones de grupo para otros grupos en la misma prueba • http://www.securityfocus.com/bid/109178 • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10189
https://notcve.org/view.php?id=CVE-2019-10189
31 Jul 2019 — A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment. Un defecto fue descubierto en moodle anterior a versiones 3.7.1, 3.6.5, los profesores en un grupo de tarea podrían modificar las anulaciones de grupo para otros grupos en la misma asignación • http://www.securityfocus.com/bid/109271 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-10154
https://notcve.org/view.php?id=CVE-2019-10154
26 Jun 2019 — A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations. Se detecto un error en Moodle antes de las versiones 3.7, 3.6.4. Un servicio web que recuperaba mensajes no se limitaba a las conversaciones del usuario actual. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10154 • CWE-285: Improper Authorization •
CVSS: 5.4EPSS: 1%CPEs: 4EXPL: 1CVE-2019-3847
https://notcve.org/view.php?id=CVE-2019-3847
27 Mar 2019 — A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5, 3.4.8 y 3.1.17. Los usuarios con la característica "login as other us... • https://github.com/danielthatcher/moodle-login-csrf • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3852
https://notcve.org/view.php?id=CVE-2019-3852
26 Mar 2019 — A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing into account when checking user capabilities Se ha descubierto una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3. Las funciones get_with_capability_join y get_users_by_capability no tenían en cuenta el bloqueo de contexto al comprobar las capacidades del usuario. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3852 •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2019-3850
https://notcve.org/view.php?id=CVE-2019-3850
26 Mar 2019 — A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5, 3.4.8 y 3.1.17. Los enlaces con comentarios de envío de tareas se abrirían directamente (en la misma... • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3850 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2019-3849
https://notcve.org/view.php?id=CVE-2019-3849
26 Mar 2019 — A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site. Se ha detectado una vulnerabilidad en moodle, en versiones anteriores a la 3.6.3, 3.5.5 y 3.4.8. Los usuarios podrían autoasignarse un rol escalado en los cursos o el contenido al que se accede mediante LTI modificando la petición al sitio LTI del editor. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3849 • CWE-269: Improper Privilege Management CWE-285: Improper Authorization •