From f278b07f54e760e7b1dce5e0f67f663135529425 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Apr 2024 22:42:28 +0000 Subject: [PATCH] Publish Advisories GHSA-454r-jccq-96q8 GHSA-wx87-h539-4775 GHSA-3hmr-948v-5qgq GHSA-3xh5-5v5v-mfgm GHSA-92q5-2h76-vgmj GHSA-c95f-27gx-6vq9 GHSA-h7xp-7fjp-ghhc GHSA-454r-jccq-96q8 GHSA-wx87-h539-4775 GHSA-3hmr-948v-5qgq GHSA-3xh5-5v5v-mfgm GHSA-92q5-2h76-vgmj GHSA-c95f-27gx-6vq9 GHSA-h7xp-7fjp-ghhc --- .../GHSA-454r-jccq-96q8.json | 100 +++++++ .../GHSA-wx87-h539-4775.json | 118 ++++++++ .../GHSA-3hmr-948v-5qgq.json | 118 ++++++++ .../GHSA-3xh5-5v5v-mfgm.json | 106 +++++++ .../GHSA-92q5-2h76-vgmj.json | 107 +++++++ .../GHSA-c95f-27gx-6vq9.json | 261 ++++++++++++++++++ .../GHSA-h7xp-7fjp-ghhc.json | 107 +++++++ .../GHSA-454r-jccq-96q8.json | 39 --- .../GHSA-wx87-h539-4775.json | 38 --- .../GHSA-3hmr-948v-5qgq.json | 38 --- .../GHSA-3xh5-5v5v-mfgm.json | 39 --- .../GHSA-92q5-2h76-vgmj.json | 43 --- .../GHSA-c95f-27gx-6vq9.json | 58 ---- .../GHSA-h7xp-7fjp-ghhc.json | 43 --- 14 files changed, 917 insertions(+), 298 deletions(-) create mode 100644 advisories/github-reviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json create mode 100644 advisories/github-reviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json create mode 100644 advisories/github-reviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json delete mode 100644 advisories/unreviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json delete mode 100644 advisories/unreviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json diff --git a/advisories/github-reviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json b/advisories/github-reviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json new file mode 100644 index 00000000000..03b005b8afe --- /dev/null +++ b/advisories/github-reviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json @@ -0,0 +1,100 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-454r-jccq-96q8", + "modified": "2024-04-23T22:41:12Z", + "published": "2022-03-12T00:00:32Z", + "aliases": [ + "CVE-2021-32472" + ], + "summary": "Moodle Exposure of Sensitive Information to an Unauthorized Actor", + "details": "Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8.0" + }, + { + "fixed": "3.8.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9.0" + }, + { + "fixed": "3.9.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.10.0" + }, + { + "fixed": "3.10.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32472" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=422305" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200", + "CWE-862" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:41:12Z", + "nvd_published_at": "2022-03-11T18:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json b/advisories/github-reviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json new file mode 100644 index 00000000000..1d883aa460c --- /dev/null +++ b/advisories/github-reviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-wx87-h539-4775", + "modified": "2024-04-23T22:41:11Z", + "published": "2022-03-12T00:00:32Z", + "aliases": [ + "CVE-2021-32473" + ], + "summary": "Moodle Information Disclosure vulnerability", + "details": "It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5" + }, + { + "fixed": "3.5.18" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.8" + }, + { + "fixed": "3.8.9" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.9" + }, + { + "fixed": "3.9.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.10" + }, + { + "fixed": "3.10.4" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32473" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=422307" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:41:11Z", + "nvd_published_at": "2022-03-11T18:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json b/advisories/github-reviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json new file mode 100644 index 00000000000..5ff9c9535c2 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json @@ -0,0 +1,118 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3hmr-948v-5qgq", + "modified": "2024-04-23T22:41:42Z", + "published": "2022-05-17T02:44:21Z", + "aliases": [ + "CVE-2017-7491" + ], + "summary": "Moodle Cross-Site Request Forgery (CSRF)", + "details": "In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the \"number of courses displayed in the course overview block\" configuration setting.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.2" + }, + { + "fixed": "3.2.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.1" + }, + { + "fixed": "3.1.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0" + }, + { + "fixed": "3.0.10" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.7" + }, + { + "fixed": "2.7.20" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7491" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=352355" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-352" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:41:42Z", + "nvd_published_at": "2017-05-15T14:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json b/advisories/github-reviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json new file mode 100644 index 00000000000..c514c61f1d2 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json @@ -0,0 +1,106 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-3xh5-5v5v-mfgm", + "modified": "2024-04-23T22:41:39Z", + "published": "2022-05-24T17:11:48Z", + "aliases": [ + "CVE-2019-14884" + ], + "summary": "Moodle reflected Cross-site Scripting (XSS)", + "details": "A vulnerability was found in Moodle 3.7 before 3.7.3, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.7" + }, + { + "fixed": "3.7.3" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6" + }, + { + "fixed": "3.6.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.5" + }, + { + "fixed": "3.6.73.5.9" + } + ] + } + ], + "database_specific": { + "last_known_affected_version_range": "< 3.5.9" + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14884" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14884" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=393587#p1586751" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:41:39Z", + "nvd_published_at": "2020-03-18T13:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json b/advisories/github-reviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json new file mode 100644 index 00000000000..5ecd824b0d6 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-92q5-2h76-vgmj", + "modified": "2024-04-23T22:41:09Z", + "published": "2022-05-24T16:52:01Z", + "aliases": [ + "CVE-2019-10188" + ], + "summary": "moodle Improper Access Control", + "details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.7" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6.0" + }, + { + "fixed": "3.6.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.7.0" + }, + { + "fixed": "3.7.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10188" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10188" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=388569" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/109178" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:41:09Z", + "nvd_published_at": "2019-07-31T22:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json b/advisories/github-reviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json new file mode 100644 index 00000000000..9646151e2ad --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json @@ -0,0 +1,261 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c95f-27gx-6vq9", + "modified": "2024-04-23T22:40:23Z", + "published": "2022-05-14T00:57:40Z", + "aliases": [ + "CVE-2015-5243" + ], + "summary": "phpWhois arbitrary code execution via a crafted whois record", + "details": "phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "jsmitty12/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.1.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "phpwhois/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "brightlocal/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "david-garcia/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.3.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "ivankristianto/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.3.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "kazist/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "serluck/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.2.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "simple-updates/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "truckersmp/phpwhois" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "4.3.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5243" + }, + { + "type": "WEB", + "url": "https://github.com/jsmitty12/phpWhois/issues/19" + }, + { + "type": "WEB", + "url": "https://github.com/Gemorroj/phpwhois/commit/91c937e03c876ba1290b6de2a3ad953d2105fdd0" + }, + { + "type": "WEB", + "url": "https://github.com/sparc/phpWhois.org/commit/5cc572490c9053d46598ec9348a11e36a5a33a46#diff-f150ae17da7341bf6c2eff928684b3a3" + }, + { + "type": "WEB", + "url": "https://blog.nettitude.com/uk/cve-2015-5243-phpwhois-remote-code-execution" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/brightlocal/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/david-garcia/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/ivankristianto/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/kazist/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/phpwhois/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/serluck/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/simple-updates/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/truckersmp/phpwhois/CVE-2015-5243.yaml" + }, + { + "type": "WEB", + "url": "https://github.com/jsmitty12/phpWhois/blob/master/CHANGELOG.md" + }, + { + "type": "WEB", + "url": "https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180425-01_phpWhois_Code_Execution" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-94" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:40:23Z", + "nvd_published_at": "2018-08-20T21:29:00Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json b/advisories/github-reviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json new file mode 100644 index 00000000000..5e1ab05254c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json @@ -0,0 +1,107 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h7xp-7fjp-ghhc", + "modified": "2024-04-23T22:41:08Z", + "published": "2022-05-24T16:52:02Z", + "aliases": [ + "CVE-2019-10189" + ], + "summary": "moodle Improper Access Control", + "details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.7.0" + }, + { + "fixed": "3.7.1" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.6.0" + }, + { + "fixed": "3.6.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.5.7" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10189" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10189" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "https://moodle.org/mod/forum/discuss.php?d=388570" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/109271" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-284" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-04-23T22:41:08Z", + "nvd_published_at": "2019-07-31T22:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json b/advisories/unreviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json deleted file mode 100644 index eaf53e91ecb..00000000000 --- a/advisories/unreviewed/2022/03/GHSA-454r-jccq-96q8/GHSA-454r-jccq-96q8.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-454r-jccq-96q8", - "modified": "2022-03-19T00:01:19Z", - "published": "2022-03-12T00:00:32Z", - "aliases": [ - "CVE-2021-32472" - ], - "details": "Teachers exporting a forum in CSV format could receive a CSV of forums from all courses in some circumstances. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6 and 3.8 to 3.8.8 are affected.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32472" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=422305" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200", - "CWE-862" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-03-11T18:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json b/advisories/unreviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json deleted file mode 100644 index ce01f4f6829..00000000000 --- a/advisories/unreviewed/2022/03/GHSA-wx87-h539-4775/GHSA-wx87-h539-4775.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-wx87-h539-4775", - "modified": "2022-03-19T00:01:20Z", - "published": "2022-03-12T00:00:32Z", - "aliases": [ - "CVE-2021-32473" - ], - "details": "It was possible for a student to view their quiz grade before it had been released, using a quiz web service. Moodle 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32473" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=422307" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2022-03-11T18:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json b/advisories/unreviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json deleted file mode 100644 index e22ec3dba83..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-3hmr-948v-5qgq/GHSA-3hmr-948v-5qgq.json +++ /dev/null @@ -1,38 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3hmr-948v-5qgq", - "modified": "2022-05-17T02:44:21Z", - "published": "2022-05-17T02:44:21Z", - "aliases": [ - "CVE-2017-7491" - ], - "details": "In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the \"number of courses displayed in the course overview block\" configuration setting.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7491" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=352355" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-352" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2017-05-15T14:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json b/advisories/unreviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json deleted file mode 100644 index 8dac019362b..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-3xh5-5v5v-mfgm/GHSA-3xh5-5v5v-mfgm.json +++ /dev/null @@ -1,39 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-3xh5-5v5v-mfgm", - "modified": "2022-05-24T17:11:48Z", - "published": "2022-05-24T17:11:48Z", - "aliases": [ - "CVE-2019-14884" - ], - "details": "A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14884" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14884" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=393587#p1586751" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2020-03-18T13:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json b/advisories/unreviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json deleted file mode 100644 index 577173a3d5a..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-92q5-2h76-vgmj/GHSA-92q5-2h76-vgmj.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-92q5-2h76-vgmj", - "modified": "2022-05-24T16:52:01Z", - "published": "2022-05-24T16:52:01Z", - "aliases": [ - "CVE-2019-10188" - ], - "details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10188" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10188" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=388569" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/109178" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-07-31T22:15:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json b/advisories/unreviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json deleted file mode 100644 index dd1342fa7c2..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-c95f-27gx-6vq9/GHSA-c95f-27gx-6vq9.json +++ /dev/null @@ -1,58 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-c95f-27gx-6vq9", - "modified": "2022-05-14T00:57:40Z", - "published": "2022-05-14T00:57:40Z", - "aliases": [ - "CVE-2015-5243" - ], - "details": "phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-5243" - }, - { - "type": "WEB", - "url": "https://github.com/jsmitty12/phpWhois/issues/19" - }, - { - "type": "WEB", - "url": "https://github.com/Gemorroj/phpwhois/commit/91c937e03c876ba1290b6de2a3ad953d2105fdd0" - }, - { - "type": "WEB", - "url": "https://github.com/sparc/phpWhois.org/commit/5cc572490c9053d46598ec9348a11e36a5a33a46#diff-f150ae17da7341bf6c2eff928684b3a3" - }, - { - "type": "WEB", - "url": "https://blog.nettitude.com/uk/cve-2015-5243-phpwhois-remote-code-execution" - }, - { - "type": "WEB", - "url": "https://github.com/jsmitty12/phpWhois/blob/master/CHANGELOG.md" - }, - { - "type": "WEB", - "url": "https://github.com/sbaresearch/advisories/tree/public/2018/SBA-ADV-20180425-01_phpWhois_Code_Execution" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-94" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2018-08-20T21:29:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json b/advisories/unreviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json deleted file mode 100644 index cb58832d0b7..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-h7xp-7fjp-ghhc/GHSA-h7xp-7fjp-ghhc.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-h7xp-7fjp-ghhc", - "modified": "2022-05-24T16:52:02Z", - "published": "2022-05-24T16:52:02Z", - "aliases": [ - "CVE-2019-10189" - ], - "details": "A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10189" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10189" - }, - { - "type": "WEB", - "url": "https://moodle.org/mod/forum/discuss.php?d=388570" - }, - { - "type": "WEB", - "url": "http://www.securityfocus.com/bid/109271" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2019-07-31T22:15:00Z" - } -} \ No newline at end of file