CVSS: 7.3EPSS: 0%CPEs: 30EXPL: 0CVE-2016-7038
https://notcve.org/view.php?id=CVE-2016-7038
20 Jan 2017 — In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. En Moodle 2.x y 3.x, tokens de servicio web no son invalidados cuando la contraseña de usuario es cambiada o se obliga a cambiarla. • http://www.securityfocus.com/bid/93174 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 5.3EPSS: 0%CPEs: 33EXPL: 0CVE-2016-8642
https://notcve.org/view.php?id=CVE-2016-8642
20 Jan 2017 — In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. En Moodle 2.x y 3.x, el motor de consultas permite acceder a archivos que no deberían estar disponibles. • http://www.securityfocus.com/bid/94441 • CWE-284: Improper Access Control •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2016-8643
https://notcve.org/view.php?id=CVE-2016-8643
20 Jan 2017 — In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. En Moodle 2.x y 3.x, gestores del sitio no administradores podrían editar accidentalmente los administradores a través de los servicios web. • http://www.securityfocus.com/bid/94457 • CWE-284: Improper Access Control •
CVSS: 5.3EPSS: 0%CPEs: 33EXPL: 0CVE-2016-8644
https://notcve.org/view.php?id=CVE-2016-8644
20 Jan 2017 — In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. En Moodle 2.x y 3.x, la capacidad de ver notas de curso se comprueba en el contexto incorrecto. • http://www.securityfocus.com/bid/94458 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 1CVE-2016-9186
https://notcve.org/view.php?id=CVE-2016-9186
04 Nov 2016 — Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. Vulnerabilidad de carga de archivos sin restricciones en los módulos "archivos de curso legados" y "administrador de archivos" en Moodle 3.1.2 permite a usuarios remotos autenticados ejecutar código arbitrario subiendo un archivo con una extens... • http://www.securityfocus.com/bid/94190 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 3%CPEs: 1EXPL: 1CVE-2016-9187
https://notcve.org/view.php?id=CVE-2016-9187
04 Nov 2016 — Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. Vulnerabilidad de carga de archivos sin restricciones en el soporte de doble extensión en el módulo "imagen" en Moodle 3.1.2 permite a usuarios remotos autenticados ejecutar código arbitrario subiendo un archivo con una extensión ejecutable, y lu... • http://www.securityfocus.com/bid/94191 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2016-9188
https://notcve.org/view.php?id=CVE-2016-9188
04 Nov 2016 — Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters. Vulnerabilidades de XSS en Moodle CMS en o en versiones anteriores a 3.1.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de los parámetros s_additionalhtmlhead, s_additionalhtmltopofbody y s_additionalhtmlfooter parameters. • http://www.securityfocus.com/bid/94189 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2016-2156
https://notcve.org/view.php?id=CVE-2016-2156
22 May 2016 — calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request. alendar/externallib.php en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.13, 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteriores a 2.9.5 y 3.0.x en versiones... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52808 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 33EXPL: 0CVE-2016-2159
https://notcve.org/view.php?id=CVE-2016-2159
22 May 2016 — The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service request. La función save_submission en mod/assign/externallib.php en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.13, 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteriores a 2.9.5... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52901 • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 33EXPL: 0CVE-2016-2157
https://notcve.org/view.php?id=CVE-2016-2157
22 May 2016 — Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins. Vulnerabilidad de CSRF en mod/assign/adminmanageplugins.php en Moodle hasta la versión 2.6.11, 2.7.x en versiones anteriores a 2.7.13, 2.8.x en versiones anteriores a 2.8.11, 2.9.x en versiones anteri... • http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53031 • CWE-352: Cross-Site Request Forgery (CSRF) •