CVE-2011-4306
Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
- Обновитесь до 1.9.14
Опубликовано Обновлено
PatchFirst · Свежие уязвимости
Уязвимости moodle/moodle · Страница 22
За последние 30 дней в moodle/moodle опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 437
CVE-2011-4301
The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields.
- Обновитесь до 1.9.14
- Обновитесь до 2.0.5
- Обновитесь до 2.1.2
Опубликовано ОбновленоCVE-2011-4300
The file_browser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file.
- Обновитесь до 2.0.5
- Обновитесь до 2.1.2
Опубликовано ОбновленоCVE-2011-4299
Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.
- Обновитесь до 2.0.5
- Обновитесь до 2.1.2
Опубликовано ОбновленоCVE-2011-4298
Multiple cross-site request forgery (CSRF) vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data.
- Обновитесь до 2.0.5
- Обновитесь до 2.1.2
Опубликовано ОбновленоCVE-2011-4203
CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.
- Обновитесь до 1.9.15
- Обновитесь до 2.0.6
- Обновитесь до 2.1.3
Опубликовано ОбновленоCVE-2010-2230
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
- Обновитесь до 1.8.13
- Обновитесь до 1.9.9
Опубликовано ОбновленоCVE-2010-1619
Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.
- Обновитесь до 1.8.12
- Обновитесь до 1.9.8
Опубликовано ОбновленоCVE-2010-1618
Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled in an error message.
- Обновитесь до 1.8.12
- Обновитесь до 1.9.8
Опубликовано ОбновленоCVE-2010-1617
user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.
- Обновитесь до 1.8.12
- Обновитесь до 1.9.8
Опубликовано ОбновленоCVE-2010-1616
Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.
- Обновитесь до 1.8.12
- Обновитесь до 1.9.8
Опубликовано ОбновленоCVE-2010-1615
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
- Обновитесь до 1.8.12
- Обновитесь до 1.9.8
Опубликовано ОбновленоCVE-2010-1614
Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.
- Обновитесь до 1.8.12
- Обновитесь до 1.9.8
Опубликовано ОбновленоCVE-2010-1613
Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.
- Обновитесь до 1.9.8
Опубликовано ОбновленоCVE-2008-5153
spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, or (3) /tmp/spell-check-after temporary file.
- Обновитесь до 1.6.9
- Обновитесь до 1.7.7
- Обновитесь до 1.8.8
- Обновитесь до 1.9.4
Опубликовано ОбновленоCVE-2008-1502
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.
- Обновитесь до 1.8.5
Опубликовано ОбновленоCVE-2006-4936
Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and remote attack vectors.
- Обновитесь до 1.6.2
Опубликовано Обновлено
Проверьте свой сервер
Сопоставьте установленный стек и версии со свежими базами уязвимостей.