CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4303
https://notcve.org/view.php?id=CVE-2009-4303
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information. Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 almacena (1) los hashes de las contraseñas y (2) "secretos" sin especificar en ficheros de copias de seguridad, lo que permitiría a atacantes obtener información sensible. • http://docs.moodle.org/en/Moodle_1.8.11_release_notes http://docs.moodle.org/en/Moodle_1.9.7_release_notes http://moodle.org/mod/forum/discuss.php?d=139110 http://secunia.com/advisories/37614 http://www.securityfocus.com/bid/37244 http://www.vupen.com/english/advisories/2009/3455 https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html https://www.redhat.com/ar • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 15EXPL: 0CVE-2009-4304
https://notcve.org/view.php?id=CVE-2009-4304
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks. Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a v1.9.7 no utiliza variación aleatorio de contraseñas en config.php, lo que hace mas facil para los atacantes dirigir un ataque de fuerza bruta contra la contraseña. • http://docs.moodle.org/en/Moodle_1.8.11_release_notes http://docs.moodle.org/en/Moodle_1.9.7_release_notes http://moodle.org/mod/forum/discuss.php?d=139111 http://secunia.com/advisories/37614 http://www.securityfocus.com/bid/37244 http://www.vupen.com/english/advisories/2009/3455 https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html https://www.redhat.com/ar • CWE-255: Credentials Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 15EXPL: 0CVE-2009-4305
https://notcve.org/view.php?id=CVE-2009-4305
SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an "escaping issue when processing AICC CRS file (Course_Title)." Vulnerabilidad de inyección en el módulo SCORM en Moodle v1.8 anteriores a v1.8.11 y v1.9 anteriores a la v1.9.7 permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través de de vectores relacionados con un "asunto de escapado cuando se procesa un fichero AICC CRS (Course_Title)." • http://docs.moodle.org/en/Moodle_1.8.11_release_notes http://docs.moodle.org/en/Moodle_1.9.7_release_notes http://moodle.org/mod/forum/discuss.php?d=139120 http://secunia.com/advisories/37614 http://www.securityfocus.com/bid/37244 http://www.vupen.com/english/advisories/2009/3455 https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00704.html https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00730.html https://www.redhat.com/ar • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 2%CPEs: 27EXPL: 2CVE-2009-1171 – Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure
https://notcve.org/view.php?id=CVE-2009-1171
The TeX filter in Moodle 1.6 before 1.6.9+, 1.7 before 1.7.7+, 1.8 before 1.8.9, and 1.9 before 1.9.5 allows user-assisted attackers to read arbitrary files via an input command in a "$$" sequence, which causes LaTeX to include the contents of the file. El filtro TeX en Moodle v1.6 anteriores a v1.6.9+, v1.7 anteriores a v1.7.7+, v1.8 anteriores a v1.8.9, y v1.9 anteriores a v1.9.5 permite a atacantes con la intervención del usuario leer ficheros de su elección mediante un comando "input" en secuencia con "$$", provocando que LaTeX incluya el contenido del fichero. • https://www.exploit-db.com/exploits/8297 http://cvs.moodle.org/moodle/filter/tex/filter.php?r1=1.18.4.4&r2=1.18.4.5 http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00010.html http://secunia.com/advisories/34517 http://secunia.com/advisories/34557 http://secunia.com/advisories/34600 http://secunia.com/advisories/35570 http://tracker.moodle.org/browse/MDL-18552 http://www.debian.org/security/2009/dsa-1761 http://www.securityfocus.com/archive/1/5 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 1CVE-2008-6124
https://notcve.org/view.php?id=CVE-2008-6124
SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt. Vulnerabilidad de inyección SQL en la función hotpot_delete_selected_attempts en report.php en el módulo the HotPot en Moodle v1.6 anteriores a 1.6.7, v1.7 anteriores a v1.7.5, v1.8 anteriores v1.8.6, y v1.9 anteriores a v1.9.2 permite a los atacantes ejecutar arbitrariamente comandos SQL a través de un intento seleccionado manipulado. • http://cvs.moodle.org/moodle/mod/hotpot/report.php?r1=1.8.6.1&r2=1.8.6.2 http://moodle.org/mod/forum/discuss.php?d=101402 http://www.debian.org/security/2008/dsa-1691 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •