diff --git a/advisories/github-reviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json b/advisories/github-reviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json new file mode 100644 index 00000000000..c250b4bc91a --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json @@ -0,0 +1,139 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-32hg-73hp-vwc8", + "modified": "2024-01-26T20:14:34Z", + "published": "2022-05-13T01:12:38Z", + "aliases": [ + "CVE-2016-2155" + ], + "summary": "Moodle allows attackers to modify \"Exclude grade\" settings", + "details": "The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify \"Exclude grade\" settings by leveraging the Non-Editing Instructor role.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2155" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/3328dc32a75d6aa4bc92865fa236dc6d52dcb7bf" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/5208032b23b7999d7048a3da7a4b70c038d93506" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/71beedee8c82c378ed10a0569c8b19ec641df9e3" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/ad67b7eeea4abf194eb432d5958e9a7032ee2c25" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/ae66ed23b6ae8000efd4e1f612697892c9795c65" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/b74d0f8404651d9ad0d97fd7eb58a94079342eb3" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/c7f7b18adecb4a80c4f3defee31e72e591133693" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=330177" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-26T20:14:34Z", + "nvd_published_at": "2016-05-22T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json b/advisories/github-reviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json new file mode 100644 index 00000000000..f9b947ac3fe --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json @@ -0,0 +1,150 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-f5pm-c4cw-563p", + "modified": "2024-01-26T20:13:43Z", + "published": "2022-05-13T01:12:38Z", + "aliases": [ + "CVE-2016-2157" + ], + "summary": "Moodle cross-site request forgery (CSRF) vulnerability", + "details": "Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2157" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/01b19e761f94a4f3615d5c8f6314309aa83469f3" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/1452f1e1d37d816648e3e015296de59509847287" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/55ba3a26d2710ce3c5f13287b0c3538b9a934fa4" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/85984545a937b0790c355473d7295eb60b0265eb" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/a0cd21cd5cc63961243518a58e9d5d01182dbbb4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=330179" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53031" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-26T20:13:43Z", + "nvd_published_at": "2016-05-22T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json b/advisories/github-reviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json new file mode 100644 index 00000000000..5d3856a3dbf --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json @@ -0,0 +1,135 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fmq9-58q4-xjw5", + "modified": "2024-01-26T20:15:09Z", + "published": "2022-05-13T01:12:38Z", + "aliases": [ + "CVE-2016-2154" + ], + "summary": "Moodle allows attackers to discover hidden course names", + "details": "admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2154" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/214950de2a4149f0efeabf62b0978901c1c68015" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/406a0efd3720d3b9214508b2e47b8f4401061312" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/475362630ba4c5073a05b1c81caf3a7f3f373cd1" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/4e5732e7fe0e9363618039d434cb5b774a8772b0" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/89b97390d0bedd2567d61723f76caa222026d5fb" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/ff7bacf32bbe148a7ab6db3b5fa69e106e54d6a4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=330176" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51167" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-26T20:15:09Z", + "nvd_published_at": "2016-05-22T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json b/advisories/github-reviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json new file mode 100644 index 00000000000..08b90d44f68 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json @@ -0,0 +1,150 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h8vc-v44p-5r2q", + "modified": "2024-01-26T20:13:14Z", + "published": "2022-05-13T01:12:38Z", + "aliases": [ + "CVE-2016-2156" + ], + "summary": "Moodle provides calendar-event data without considering whether an activity is hidden", + "details": "calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2156" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/39b851376337b853c8d403dcba64645d16f0a9bd" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/783e695e00689d67925d6f83722d344c0bd6de94" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/854e7b8ed0a84eb91ca455ca290427d22bc20baf" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/c631b112d6e729c84f5d559371a399fe54502ba3" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/d63ac148b95e5f909618e75efd76f6b5032da158" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=330178" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52808" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-26T20:13:14Z", + "nvd_published_at": "2016-05-22T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json b/advisories/github-reviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json new file mode 100644 index 00000000000..3e202fec435 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json @@ -0,0 +1,150 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m882-j7gq-v9p7", + "modified": "2024-01-26T20:14:55Z", + "published": "2022-05-13T01:12:38Z", + "aliases": [ + "CVE-2016-2158" + ], + "summary": "Moodle allows attackers to obtain sensitive category-detail information", + "details": "lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2158" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/0766509ab02353008af62f953f7ebc0f6210411a" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/3c069c16db62d0e0a64137578e92c22d604dd261" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/7b9fbb1cf4228b39f81454cdb8370e7853fbe184" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/dc8421575f35585a7a4fc1c9710dafd1d0483d4e" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/ea8987644fdbbee291337263598b0c3c7bf27c36" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=330180" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52774" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-26T20:14:55Z", + "nvd_published_at": "2016-05-22T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json b/advisories/github-reviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json new file mode 100644 index 00000000000..2968a627703 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json @@ -0,0 +1,150 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-r3fc-hx6q-g6cq", + "modified": "2024-01-26T20:14:11Z", + "published": "2022-05-13T01:12:38Z", + "aliases": [ + "CVE-2016-2151" + ], + "summary": "Moodle allows attackers to discover student e-mail addresses", + "details": "user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.7.13" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.8.0" + }, + { + "fixed": "2.8.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.9.0" + }, + { + "fixed": "2.9.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.3" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2151" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/089ab60017cd3207990658fbd37f7f31948539fa" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/094fddd00f2e8e832e21e80f417c7b88b33a1f27" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/85380c6b616e82e31115fbb585d37f0e15f8b0b2" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/8e24a54e526c149469bd77c910876c4489e87841" + }, + { + "type": "WEB", + "url": "https://github.com/moodle/moodle/commit/a0034bb01773e36dffed2a665646f9cc31d68d5b" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=330173" + }, + { + "type": "WEB", + "url": "https://web.archive.org/web/20160424224349/http://www.securitytracker.com/id/1035333" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52433" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-26T20:14:11Z", + "nvd_published_at": "2016-05-22T20:59:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json b/advisories/unreviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json deleted file mode 100644 index 94d5ff5fb01..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-32hg-73hp-vwc8/GHSA-32hg-73hp-vwc8.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-32hg-73hp-vwc8", - "modified": "2022-05-13T01:12:38Z", - "published": "2022-05-13T01:12:38Z", - "aliases": [ - "CVE-2016-2155" - ], - "details": "The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify \"Exclude grade\" settings by leveraging the Non-Editing Instructor role.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2155" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=330177" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52378" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1035333" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-05-22T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json b/advisories/unreviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json deleted file mode 100644 index 7f12c7a8bb8..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-f5pm-c4cw-563p/GHSA-f5pm-c4cw-563p.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-f5pm-c4cw-563p", - "modified": "2022-05-13T01:12:38Z", - "published": "2022-05-13T01:12:38Z", - "aliases": [ - "CVE-2016-2157" - ], - "details": "Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2157" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=330179" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53031" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1035333" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-05-22T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json b/advisories/unreviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json deleted file mode 100644 index a456635d823..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-fmq9-58q4-xjw5/GHSA-fmq9-58q4-xjw5.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fmq9-58q4-xjw5", - "modified": "2022-05-13T01:12:38Z", - "published": "2022-05-13T01:12:38Z", - "aliases": [ - "CVE-2016-2154" - ], - "details": "admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by subscribing to a rule.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2154" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=330176" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51167" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1035333" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-05-22T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json b/advisories/unreviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json deleted file mode 100644 index 4e34bcca5ca..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-h8vc-v44p-5r2q/GHSA-h8vc-v44p-5r2q.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-h8vc-v44p-5r2q", - "modified": "2022-05-13T01:12:38Z", - "published": "2022-05-13T01:12:38Z", - "aliases": [ - "CVE-2016-2156" - ], - "details": "calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2156" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=330178" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52808" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1035333" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-05-22T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json b/advisories/unreviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json deleted file mode 100644 index d5fdfab5cc5..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m882-j7gq-v9p7/GHSA-m882-j7gq-v9p7.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-m882-j7gq-v9p7", - "modified": "2022-05-13T01:12:38Z", - "published": "2022-05-13T01:12:38Z", - "aliases": [ - "CVE-2016-2158" - ], - "details": "lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2158" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=330180" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52774" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1035333" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-05-22T20:59:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json b/advisories/unreviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json deleted file mode 100644 index 759151e4dd5..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-r3fc-hx6q-g6cq/GHSA-r3fc-hx6q-g6cq.json +++ /dev/null @@ -1,50 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-r3fc-hx6q-g6cq", - "modified": "2022-05-13T01:12:38Z", - "published": "2022-05-13T01:12:38Z", - "aliases": [ - "CVE-2016-2151" - ], - "details": "user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated users to discover student e-mail addresses by leveraging the teacher role and reading a Participants list.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2151" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=330173" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52433" - }, - { - "type": "WEB", - "url": "http://www.openwall.com/lists/oss-security/2016/03/21/1" - }, - { - "type": "WEB", - "url": "http://www.securitytracker.com/id/1035333" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2016-05-22T20:59:00Z" - } -} \ No newline at end of file