CVSS: 7.3EPSS: 0%CPEs: 30EXPL: 0CVE-2016-7038
https://notcve.org/view.php?id=CVE-2016-7038
20 Jan 2017 — In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed. En Moodle 2.x y 3.x, tokens de servicio web no son invalidados cuando la contraseña de usuario es cambiada o se obliga a cambiarla. • http://www.securityfocus.com/bid/93174 • CWE-640: Weak Password Recovery Mechanism for Forgotten Password •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 1CVE-2016-9186
https://notcve.org/view.php?id=CVE-2016-9186
04 Nov 2016 — Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. Vulnerabilidad de carga de archivos sin restricciones en los módulos "archivos de curso legados" y "administrador de archivos" en Moodle 3.1.2 permite a usuarios remotos autenticados ejecutar código arbitrario subiendo un archivo con una extens... • http://www.securityfocus.com/bid/94190 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 4%CPEs: 1EXPL: 1CVE-2016-9187
https://notcve.org/view.php?id=CVE-2016-9187
04 Nov 2016 — Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. Vulnerabilidad de carga de archivos sin restricciones en el soporte de doble extensión en el módulo "imagen" en Moodle 3.1.2 permite a usuarios remotos autenticados ejecutar código arbitrario subiendo un archivo con una extensión ejecutable, y lu... • http://www.securityfocus.com/bid/94191 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2016-9188
https://notcve.org/view.php?id=CVE-2016-9188
04 Nov 2016 — Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters. Vulnerabilidades de XSS en Moodle CMS en o en versiones anteriores a 3.1.2 permiten a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de los parámetros s_additionalhtmlhead, s_additionalhtmltopofbody y s_additionalhtmlfooter parameters. • http://www.securityfocus.com/bid/94189 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 91EXPL: 0CVE-2013-7341
https://notcve.org/view.php?id=CVE-2013-7341
22 Mar 2014 — Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342. Múltiples vulnerabilidades de XSS en Flowplayer Flash anterior a 3.2.17, utilizado en Moodle hasta 2.3.11, 2.4.x anterior a 2.4.9, 2.5.x anterior a 2.5.5 y ... • http://flash.flowplayer.org/documentation/version-history.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •