netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-32hg-73hp-vwc8
GHSA-f5pm-c4cw-563p
GHSA-fmq9-58q4-xjw5
GHSA-h8vc-v44p-5r2q
GHSA-m882-j7gq-v9p7
GHSA-r3fc-hx6q-g6cq
GHSA-32hg-73hp-vwc8
GHSA-f5pm-c4cw-563p
GHSA-fmq9-58q4-xjw5
GHSA-h8vc-v44p-5r2q
GHSA-m882-j7gq-v9p7
GHSA-r3fc-hx6q-g6cq
This commit is contained in:
advisory-database[bot]
2024-01-26 20:15:49 +00:00
parent 872e8efcb6
commit c8ccfbed64
12 changed files with 874 additions and 300 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json
+139
View File
@@ -0,0 +1,139 @@
{
"schema_version": "1.4.0",
"id": "GHSA-32hg-73hp-vwc8",
"modified": "2024-01-26T20:14:34Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2155"
],
"summary": "Moodle allows attackers to modify \"Exclude grade\" settings",
"details": "The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify \"Exclude grade\" settings by leveraging the Non-Editing Instructor role.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2155"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/3328dc32a75d6aa4bc92865fa236dc6d52dcb7bf"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/5208032b23b7999d7048a3da7a4b70c038d93506"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/71beedee8c82c378ed10a0569c8b19ec641df9e3"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/ad67b7eeea4abf194eb432d5958e9a7032ee2c25"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/ae66ed23b6ae8000efd4e1f612697892c9795c65"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/b74d0f8404651d9ad0d97fd7eb58a94079342eb3"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/c7f7b18adecb4a80c4f3defee31e72e591133693"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330177"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-26T20:14:34Z",
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json
+150
View File
@@ -0,0 +1,150 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f5pm-c4cw-563p",
"modified": "2024-01-26T20:13:43Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2157"
],
"summary": "Moodle cross-site request forgery (CSRF) vulnerability",
"details": "Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2157"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/01b19e761f94a4f3615d5c8f6314309aa83469f3"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/1452f1e1d37d816648e3e015296de59509847287"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/55ba3a26d2710ce3c5f13287b0c3538b9a934fa4"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/85984545a937b0790c355473d7295eb60b0265eb"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/a0cd21cd5cc63961243518a58e9d5d01182dbbb4"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330179"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53031"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-01-26T20:13:43Z",
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json
+135
View File
@@ -0,0 +1,135 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fmq9-58q4-xjw5",
"modified": "2024-01-26T20:15:09Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2154"
],
"summary": "Moodle allows attackers to discover hidden course names",
"details": "admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2154"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/214950de2a4149f0efeabf62b0978901c1c68015"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/406a0efd3720d3b9214508b2e47b8f4401061312"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/475362630ba4c5073a05b1c81caf3a7f3f373cd1"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/4e5732e7fe0e9363618039d434cb5b774a8772b0"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/89b97390d0bedd2567d61723f76caa222026d5fb"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/ff7bacf32bbe148a7ab6db3b5fa69e106e54d6a4"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330176"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51167"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-26T20:15:09Z",
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json
+150
View File
@@ -0,0 +1,150 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h8vc-v44p-5r2q",
"modified": "2024-01-26T20:13:14Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2156"
],
"summary": "Moodle provides calendar-event data without considering whether an activity is hidden",
"details": "calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2156"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/39b851376337b853c8d403dcba64645d16f0a9bd"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/783e695e00689d67925d6f83722d344c0bd6de94"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/854e7b8ed0a84eb91ca455ca290427d22bc20baf"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/c631b112d6e729c84f5d559371a399fe54502ba3"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/d63ac148b95e5f909618e75efd76f6b5032da158"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330178"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52808"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-26T20:13:14Z",
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json
+150
View File
@@ -0,0 +1,150 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m882-j7gq-v9p7",
"modified": "2024-01-26T20:14:55Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2158"
],
"summary": "Moodle allows attackers to obtain sensitive category-detail information",
"details": "lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2158"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/0766509ab02353008af62f953f7ebc0f6210411a"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/3c069c16db62d0e0a64137578e92c22d604dd261"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/7b9fbb1cf4228b39f81454cdb8370e7853fbe184"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/dc8421575f35585a7a4fc1c9710dafd1d0483d4e"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/ea8987644fdbbee291337263598b0c3c7bf27c36"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330180"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52774"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-26T20:14:55Z",
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json
+150
View File
@@ -0,0 +1,150 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r3fc-hx6q-g6cq",
"modified": "2024-01-26T20:14:11Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2151"
],
"summary": "Moodle allows attackers to discover student e-mail addresses",
"details": "user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.7.13"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2151"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/089ab60017cd3207990658fbd37f7f31948539fa"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/094fddd00f2e8e832e21e80f417c7b88b33a1f27"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/85380c6b616e82e31115fbb585d37f0e15f8b0b2"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/8e24a54e526c149469bd77c910876c4489e87841"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/a0034bb01773e36dffed2a665646f9cc31d68d5b"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330173"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52433"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-01-26T20:14:11Z",
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-32hg-73hp-vwc8",
"modified": "2022-05-13T01:12:38Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2155"
],
"details": "The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify \"Exclude grade\" settings by leveraging the Non-Editing Instructor role.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2155"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330177"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035333"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-f5pm-c4cw-563p",
"modified": "2022-05-13T01:12:38Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2157"
],
"details": "Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2157"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330179"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53031"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035333"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fmq9-58q4-xjw5",
"modified": "2022-05-13T01:12:38Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2154"
],
"details": "admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2154"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330176"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51167"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035333"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-h8vc-v44p-5r2q",
"modified": "2022-05-13T01:12:38Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2156"
],
"details": "calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2156"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330178"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52808"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035333"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m882-j7gq-v9p7",
"modified": "2022-05-13T01:12:38Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2158"
],
"details": "lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2158"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330180"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52774"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035333"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r3fc-hx6q-g6cq",
"modified": "2022-05-13T01:12:38Z",
"published": "2022-05-13T01:12:38Z",
"aliases": [
"CVE-2016-2151"
],
"details": "user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2151"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=330173"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52433"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/03/21/1"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1035333"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-05-22T20:59:00Z"
}
}