From 51f3e59bb2e79986d8950aba0c253fa85a6b0047 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Fri, 11 Apr 2025 20:04:56 +0000 Subject: [PATCH] Publish Advisories GHSA-5fgv-cvr8-xg48 GHSA-hhxf-w8hj-43w6 GHSA-5fgv-cvr8-xg48 GHSA-hhxf-w8hj-43w6 --- .../GHSA-5fgv-cvr8-xg48.json | 84 ++++++++++++++++++ .../GHSA-hhxf-w8hj-43w6.json | 88 +++++++++++++++++++ .../GHSA-5fgv-cvr8-xg48.json | 39 -------- .../GHSA-hhxf-w8hj-43w6.json | 39 -------- 4 files changed, 172 insertions(+), 78 deletions(-) create mode 100644 advisories/github-reviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json diff --git a/advisories/github-reviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json b/advisories/github-reviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json new file mode 100644 index 00000000000..160eadbefb4 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json @@ -0,0 +1,84 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5fgv-cvr8-xg48", + "modified": "2025-04-11T20:02:27Z", + "published": "2022-05-13T01:13:08Z", + "aliases": [ + "CVE-2010-1614" + ], + "summary": "Moodle vulnerable to Cross-site Scripting", + "details": "Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9.0" + }, + { + "fixed": "1.9.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1614" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" + }, + { + "type": "WEB", + "url": "http://moodle.org/security" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T20:02:27Z", + "nvd_published_at": "2010-04-29T21:30:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json b/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json new file mode 100644 index 00000000000..01c93936757 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json @@ -0,0 +1,88 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-hhxf-w8hj-43w6", + "modified": "2025-04-11T20:02:58Z", + "published": "2022-05-13T01:13:08Z", + "aliases": [ + "CVE-2010-1619" + ], + "summary": "Moodle vulnerable to Cross-site Scripting", + "details": "Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.8.0" + }, + { + "fixed": "1.8.12" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9.0" + }, + { + "fixed": "1.9.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1619" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" + }, + { + "type": "WEB", + "url": "http://moodle.org/security" + }, + { + "type": "WEB", + "url": "http://www.vupen.com/english/advisories/2010/1107" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-11T20:02:58Z", + "nvd_published_at": "2010-04-29T21:30:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json b/advisories/unreviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json deleted file mode 100644 index 684bc164d17..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-5fgv-cvr8-xg48/GHSA-5fgv-cvr8-xg48.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-5fgv-cvr8-xg48", - "modified": "2025-04-11T03:34:29Z", - "published": "2022-05-13T01:13:08Z", - "aliases": [ - "CVE-2010-1614" - ], - "details": "Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1614" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" - }, - { - "type": "WEB", - "url": "http://moodle.org/security" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/1107" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2010-04-29T21:30:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json b/advisories/unreviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json deleted file mode 100644 index a078c8832de..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-hhxf-w8hj-43w6/GHSA-hhxf-w8hj-43w6.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-hhxf-w8hj-43w6", - "modified": "2025-04-11T03:34:29Z", - "published": "2022-05-13T01:13:08Z", - "aliases": [ - "CVE-2010-1619" - ], - "details": "Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-1619" - }, - { - "type": "WEB", - "url": "http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html" - }, - { - "type": "WEB", - "url": "http://moodle.org/security" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/1107" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2010-04-29T21:30:00Z" - } -} \ No newline at end of file