diff --git a/advisories/github-reviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json b/advisories/github-reviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json new file mode 100644 index 00000000000..160eadbefb4 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fgv-cvr8-xg48", + "modified": "2025-04-11T20:02:27Z", + "published": "2022-05-13T01:13:08Z", + "aliases": [ + "CVE-2010-1614" + ], + "summary": "Moodle vulnerable to Cross-site Scripting", + "details": "Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9.0" + }, + { + "fixed": "1.9.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1614" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" + }, + { + "type": "WEB", + "url": "http://moodle.org/security" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T20:02:27Z", + "nvd_published_at": "2010-04-29T21:30:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json b/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json new file mode 100644 index 00000000000..01c93936757 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hhxf-w8hj-43w6", + "modified": "2025-04-11T20:02:58Z", + "published": "2022-05-13T01:13:08Z", + "aliases": [ + "CVE-2010-1619" + ], + "summary": "Moodle vulnerable to Cross-site Scripting", + "details": "Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9.0" + }, + { + "fixed": "1.9.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1619" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" + }, + { + "type": "WEB", + "url": "http://moodle.org/security" + }, + { + "type": "WEB", + "url": "http://www.vupen.com/english/advisories/2010/1107" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T20:02:58Z", + "nvd_published_at": "2010-04-29T21:30:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json b/advisories/unreviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json deleted file mode 100644 index 684bc164d17..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5fgv-cvr8-xg48", - "modified": "2025-04-11T03:34:29Z", - "published": "2022-05-13T01:13:08Z", - "aliases": [ - "CVE-2010-1614" - ], - "details": "Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1614" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" - }, - { - "type": "WEB", - "url": "http://moodle.org/security" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/1107" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2010-04-29T21:30:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json b/advisories/unreviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json deleted file mode 100644 index a078c8832de..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hhxf-w8hj-43w6", - "modified": "2025-04-11T03:34:29Z", - "published": "2022-05-13T01:13:08Z", - "aliases": [ - "CVE-2010-1619" - ], - "details": "Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1619" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" - }, - { - "type": "WEB", - "url": "http://moodle.org/security" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/1107" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2010-04-29T21:30:00Z" - } -} \ No newline at end of file