netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-04-23 23:42:31 +00:00
parent fc106d221f
commit c41f1b3ba1
27 changed files with 1592 additions and 544 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2phx-w35g-x9vm",
"modified": "2024-04-23T23:41:16Z",
"published": "2022-05-13T01:12:40Z",
"aliases": [
"CVE-2016-7038"
],
"summary": "Moodle Weak Password Recovery Mechanism for Forgotten Password",
"details": "In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.7"
},
{
"fixed": "2.7.16"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9"
},
{
"fixed": "2.9.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7038"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=339631"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93174"
}
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:16Z",
"nvd_published_at": "2017-01-20T08:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json
+103
View File
@@ -0,0 +1,103 @@
{
"schema_version": "1.4.0",
"id": "GHSA-45rw-4r25-jvg7",
"modified": "2024-04-23T23:41:57Z",
"published": "2022-05-13T01:05:22Z",
"aliases": [
"CVE-2019-3848"
],
"summary": "Moodle Logged in users could view all calendar events",
"details": "A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.5"
},
{
"fixed": "3.5.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.6"
},
{
"fixed": "3.6.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3848"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=384011#p1547743"
}
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:57Z",
"nvd_published_at": "2019-03-26T18:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json
+126
View File
@@ -0,0 +1,126 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5w4h-xrr5-7273",
"modified": "2024-04-23T23:41:46Z",
"published": "2022-05-13T01:34:55Z",
"aliases": [
"CVE-2018-10890"
],
"summary": "Moodle Exposure of Sensitive Information to an Unauthorized Actor",
"details": "A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.5"
},
{
"fixed": "3.5.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10890"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=373370"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104738"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:46Z",
"nvd_published_at": "2018-07-10T18:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cjrf-xg77-chpw",
"modified": "2024-04-23T23:41:20Z",
"published": "2022-05-13T01:12:40Z",
"aliases": [
"CVE-2017-2576"
],
"summary": "Moodle Incorrect sanitation of attributes in forums",
"details": "In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.7"
},
{
"fixed": "2.7.18"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2576"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=345912"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95649"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:20Z",
"nvd_published_at": "2017-01-20T08:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json
+126
View File
@@ -0,0 +1,126 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g96h-wvrm-c2ww",
"modified": "2024-04-23T23:41:12Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-3729"
],
"summary": "Moodle Improper Access Control",
"details": "The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.3"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9"
},
{
"fixed": "2.9.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8"
},
{
"fixed": "2.8.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.7"
},
{
"fixed": "2.7.14"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3729"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335933"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/17/4"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035902"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:12Z",
"nvd_published_at": "2017-04-20T21:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json → advisories/github-reviewed/2022/05/GHSA-gj2j-ppjq-9pjg/GHSA-gj2j-ppjq-9pjg.json
+65 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-gj2j-ppjq-9pjg",
"modified": "2022-05-13T01:12:38Z",
"modified": "2024-04-23T23:41:09Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-0725"
],
"summary": "Moodle Cross-site scripting (XSS) vulnerability in course management search",
"details": "Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.",
"severity": [
{
@@ -14,13 +15,73 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8"
},
{
"fixed": "2.8.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9"
},
{
"fixed": "2.9.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-0725"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=326206"
@@ -51,8 +112,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:09Z",
"nvd_published_at": "2016-02-22T05:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-hpwm-84h5-vqr8/GHSA-hpwm-84h5-vqr8.json
+103
View File
@@ -0,0 +1,103 @@
{
"schema_version": "1.4.0",
"id": "GHSA-hpwm-84h5-vqr8",
"modified": "2024-04-23T23:41:49Z",
"published": "2022-05-13T01:48:49Z",
"aliases": [
"CVE-2018-1043"
],
"summary": "Moodle Setting for blocked hosts list can be bypassed with multiple A record hostnames",
"details": "In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1043"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=364382"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102769"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:49Z",
"nvd_published_at": "2018-01-22T08:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json → advisories/github-reviewed/2022/05/GHSA-jp4g-r8c9-3534/GHSA-jp4g-r8c9-3534.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-jp4g-r8c9-3534",
"modified": "2022-05-13T01:31:16Z",
"modified": "2024-04-23T23:41:33Z",
"published": "2022-05-13T01:31:16Z",
"aliases": [
"CVE-2019-3809"
],
"summary": "Moodle Blind SSRF Risk in /badges/mybackpack.php",
"details": "A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.16"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3809"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=381229#p1536766"
@@ -39,8 +62,8 @@
"CWE-918"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:33Z",
"nvd_published_at": "2019-03-25T18:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json → advisories/github-reviewed/2022/05/GHSA-qh8m-6g4p-33h3/GHSA-qh8m-6g4p-33h3.json
+46 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-qh8m-6g4p-33h3",
"modified": "2022-05-13T01:33:33Z",
"modified": "2024-04-23T23:41:39Z",
"published": "2022-05-13T01:33:33Z",
"aliases": [
"CVE-2018-1082"
],
"summary": "Moodle Improper Authentication",
"details": "A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.",
"severity": [
{
@@ -14,13 +15,54 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1082"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=367939"
@@ -39,8 +81,8 @@
"CWE-287"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:39Z",
"nvd_published_at": "2018-04-04T21:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-v9xq-vh72-chr4/GHSA-v9xq-vh72-chr4.json
+126
View File
@@ -0,0 +1,126 @@
{
"schema_version": "1.4.0",
"id": "GHSA-v9xq-vh72-chr4",
"modified": "2024-04-23T23:41:24Z",
"published": "2022-05-13T01:17:55Z",
"aliases": [
"CVE-2018-1081"
],
"summary": "Moodle Unauthenticated users can trigger custom messages to admin via paypal enrol script",
"details": "A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.8"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1081"
},
{
"type": "WEB",
"url": "https://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-61392"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=367938"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/103728"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:24Z",
"nvd_published_at": "2018-04-04T21:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-vxmv-74rf-vqgp/GHSA-vxmv-74rf-vqgp.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vxmv-74rf-vqgp",
"modified": "2024-04-23T23:42:05Z",
"published": "2022-05-14T03:16:24Z",
"aliases": [
"CVE-2018-1135"
],
"summary": "Moodle Portfolio forum caller class allows a user to download any file",
"details": "An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1135"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=371201"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104307"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:42:05Z",
"nvd_published_at": "2018-05-25T12:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-vxqh-mx28-7ghw/GHSA-vxqh-mx28-7ghw.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vxqh-mx28-7ghw",
"modified": "2024-04-23T23:42:01Z",
"published": "2022-05-14T03:16:23Z",
"aliases": [
"CVE-2018-1137"
],
"summary": "Moodle Portfolio script allows instantiation of class chosen by user",
"details": "An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1137"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=371204"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104307"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:42:01Z",
"nvd_published_at": "2018-05-25T12:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-xh2j-q4mc-v522/GHSA-xh2j-q4mc-v522.json
+126
View File
@@ -0,0 +1,126 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xh2j-q4mc-v522",
"modified": "2024-04-23T23:41:29Z",
"published": "2022-05-13T01:18:54Z",
"aliases": [
"CVE-2018-1133"
],
"summary": "Moodle calculated question type allows remote code execution by Question authors",
"details": "An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1133"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=371199"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/46551"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104307"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:29Z",
"nvd_published_at": "2018-05-25T12:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-xj5f-qv37-r9jc/GHSA-xj5f-qv37-r9jc.json
+134
View File
@@ -0,0 +1,134 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xj5f-qv37-r9jc",
"modified": "2024-04-23T23:41:43Z",
"published": "2022-05-13T01:34:04Z",
"aliases": [
"CVE-2018-16854"
],
"summary": "Moodle Login CSRF vulnerability in login form",
"details": "A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.15"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.5"
},
{
"fixed": "3.5.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16854"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16854"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=378731"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-63183"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106017"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1042154"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:42Z",
"nvd_published_at": "2018-11-26T17:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-xjx9-7c29-pwmm/GHSA-xjx9-7c29-pwmm.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xjx9-7c29-pwmm",
"modified": "2024-04-23T23:41:52Z",
"published": "2022-05-13T01:49:11Z",
"aliases": [
"CVE-2018-1134"
],
"summary": "Moodle Improper Privilege Management ",
"details": "An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1134"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=371200"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104307"
}
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:41:52Z",
"nvd_published_at": "2018-05-25T12:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-2phx-w35g-x9vm/GHSA-2phx-w35g-x9vm.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2phx-w35g-x9vm",
"modified": "2022-05-13T01:12:40Z",
"published": "2022-05-13T01:12:40Z",
"aliases": [
"CVE-2016-7038"
],
"details": "In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-7038"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=339631"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93174"
}
],
"database_specific": {
"cwe_ids": [
"CWE-640"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-01-20T08:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-45rw-4r25-jvg7/GHSA-45rw-4r25-jvg7.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-45rw-4r25-jvg7",
"modified": "2022-05-13T01:05:22Z",
"published": "2022-05-13T01:05:22Z",
"aliases": [
"CVE-2019-3848"
],
"details": "A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3848"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3848"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=384011#p1547743"
}
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-26T18:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-5w4h-xrr5-7273/GHSA-5w4h-xrr5-7273.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-5w4h-xrr5-7273",
"modified": "2022-05-13T01:34:55Z",
"published": "2022-05-13T01:34:55Z",
"aliases": [
"CVE-2018-10890"
],
"details": "A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10890"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10890"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=373370"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104738"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-10T18:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-cjrf-xg77-chpw/GHSA-cjrf-xg77-chpw.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-cjrf-xg77-chpw",
"modified": "2022-05-13T01:12:40Z",
"published": "2022-05-13T01:12:40Z",
"aliases": [
"CVE-2017-2576"
],
"details": "In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2576"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=345912"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/95649"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-01-20T08:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-g96h-wvrm-c2ww/GHSA-g96h-wvrm-c2ww.json
-46
View File
@@ -1,46 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-g96h-wvrm-c2ww",
"modified": "2022-05-13T01:12:38Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-3729"
],
"details": "The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3729"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1335933"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/05/17/4"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035902"
}
],
"database_specific": {
"cwe_ids": [
"CWE-284"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-20T21:59:00Z"
}
}

Some files were not shown because too many files have changed in this diff Show More