CVE-2011-4306
Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
- Actualiza a 1.9.14
Publicación Actualización
PatchFirst · Vulnerabilidades recientes
Vulnerabilidades de moodle/moodle · Página 22
Vulnerabilidades publicadas para moodle/moodle en los últimos 30 días: 0. Incluidas en el catálogo KEV: 0.
Vulnerabilidades: 437
CVE-2011-4301
The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields.
- Actualiza a 1.9.14
- Actualiza a 2.0.5
- Actualiza a 2.1.2
Publicación ActualizaciónCVE-2011-4300
The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.
- Actualiza a 2.0.5
- Actualiza a 2.1.2
Publicación ActualizaciónCVE-2011-4299
Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.
- Actualiza a 2.0.5
- Actualiza a 2.1.2
Publicación ActualizaciónCVE-2011-4298
Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.
- Actualiza a 2.0.5
- Actualiza a 2.1.2
Publicación ActualizaciónCVE-2011-4203
CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.
- Actualiza a 1.9.15
- Actualiza a 2.0.6
- Actualiza a 2.1.3
Publicación ActualizaciónCVE-2010-2230
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Actualiza a 1.8.13
- Actualiza a 1.9.9
Publicación ActualizaciónCVE-2010-1619
Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.
- Actualiza a 1.8.12
- Actualiza a 1.9.8
Publicación ActualizaciónCVE-2010-1618
Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message.
- Actualiza a 1.8.12
- Actualiza a 1.9.8
Publicación ActualizaciónCVE-2010-1617
user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.
- Actualiza a 1.8.12
- Actualiza a 1.9.8
Publicación ActualizaciónCVE-2010-1616
Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.
- Actualiza a 1.8.12
- Actualiza a 1.9.8
Publicación ActualizaciónCVE-2010-1615
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- Actualiza a 1.8.12
- Actualiza a 1.9.8
Publicación ActualizaciónCVE-2010-1614
Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.
- Actualiza a 1.8.12
- Actualiza a 1.9.8
Publicación ActualizaciónCVE-2010-1613
Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.
- Actualiza a 1.9.8
Publicación ActualizaciónCVE-2008-5153
spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, or (3) /tmp/spell-check-after temporary file.
- Actualiza a 1.6.9
- Actualiza a 1.7.7
- Actualiza a 1.8.8
- Actualiza a 1.9.4
Publicación ActualizaciónCVE-2008-1502
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.
- Actualiza a 1.8.5
Publicación ActualizaciónCVE-2006-4936
Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and remote attack vectors.
- Actualiza a 1.6.2
Publicación Actualización
Comprueba tu servidor
Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.