netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-332g-xh34-5c96
GHSA-54r2-r67g-fr9m
GHSA-rjh8-w8jg-xwq5
GHSA-xhfw-wjjc-4j5h
GHSA-xhq3-455r-xv44
GHSA-2hmm-q272-xmhf
GHSA-385f-vgq7-8hhx
GHSA-mqw9-3cjm-xwp3
GHSA-xjr3-fwp9-9g96
GHSA-6gx2-g773-hv9h
GHSA-xv72-6pgh-cjj8
GHSA-332g-xh34-5c96
GHSA-54r2-r67g-fr9m
GHSA-rjh8-w8jg-xwq5
GHSA-xhfw-wjjc-4j5h
GHSA-xhq3-455r-xv44
GHSA-2hmm-q272-xmhf
GHSA-385f-vgq7-8hhx
GHSA-mqw9-3cjm-xwp3
GHSA-xjr3-fwp9-9g96
This commit is contained in:
advisory-database[bot]
2024-04-23 23:44:36 +00:00
parent c41f1b3ba1
commit f450d6269f
20 changed files with 1089 additions and 394 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-332g-xh34-5c96",
"modified": "2024-04-23T23:42:08Z",
"published": "2022-05-14T03:46:14Z",
"aliases": [
"CVE-2018-1044"
],
"summary": "Moodle Privilege escalation in quiz web services",
"details": "In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1044"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=364383"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102754"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:42:08Z",
"nvd_published_at": "2018-01-22T08:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json
+103
View File
@@ -0,0 +1,103 @@
{
"schema_version": "1.4.0",
"id": "GHSA-54r2-r67g-fr9m",
"modified": "2024-04-23T23:42:19Z",
"published": "2022-05-17T02:27:46Z",
"aliases": [
"CVE-2017-2642"
],
"summary": "Moodle User fullname disclosure on user preferences page",
"details": "Moodle 3.x has user fullname disclosure on the user preferences page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.7"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.4"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2642"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=355554"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99606"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:42:19Z",
"nvd_published_at": "2017-07-17T17:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json
+103
View File
@@ -0,0 +1,103 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rjh8-w8jg-xwq5",
"modified": "2024-04-23T23:42:11Z",
"published": "2022-05-17T00:18:11Z",
"aliases": [
"CVE-2017-15110"
],
"summary": "Moodle Exposure of Sensitive Information to an Unauthorized Actor",
"details": "In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15110"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=361784"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101909"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:42:11Z",
"nvd_published_at": "2017-11-20T14:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json
+122
View File
@@ -0,0 +1,122 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xhfw-wjjc-4j5h",
"modified": "2024-04-23T23:43:39Z",
"published": "2022-05-13T01:49:13Z",
"aliases": [
"CVE-2018-1136"
],
"summary": "Moodle Cross-site Scripting",
"details": "An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.12"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.3"
},
{
"fixed": "3.3.6"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.4"
},
{
"fixed": "3.4.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1136"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=371202"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104307"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:43:39Z",
"nvd_published_at": "2018-05-25T12:29:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json
+130
View File
@@ -0,0 +1,130 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xhq3-455r-xv44",
"modified": "2024-04-23T23:42:15Z",
"published": "2022-05-17T02:12:39Z",
"aliases": [
"CVE-2017-2641"
],
"summary": "Moodle SQL injection via user preferences",
"details": "In Moodle 2.x and 3.x, SQL injection can occur via user preferences.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.7"
},
{
"fixed": "2.7.19"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0"
},
{
"fixed": "3.0.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.1"
},
{
"fixed": "3.1.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.2"
},
{
"fixed": "3.2.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2641"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=349419"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41828"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96977"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038174"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:42:15Z",
"nvd_published_at": "2017-03-26T18:59:00Z"
}
}
advisories/github-reviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json
+107
View File
@@ -0,0 +1,107 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2hmm-q272-xmhf",
"modified": "2024-04-23T23:43:09Z",
"published": "2022-10-01T00:00:20Z",
"aliases": [
"CVE-2022-40314"
],
"summary": "Moodle remote code execution",
"details": "A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.17"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40314"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128147"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=438393"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75405"
}
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:43:09Z",
"nvd_published_at": "2022-09-30T17:15:00Z"
}
}
advisories/github-reviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json
+104
View File
@@ -0,0 +1,104 @@
{
"schema_version": "1.4.0",
"id": "GHSA-385f-vgq7-8hhx",
"modified": "2024-04-23T23:43:22Z",
"published": "2022-10-01T00:00:20Z",
"aliases": [
"CVE-2022-40316"
],
"summary": "Moodle No groups filtering in H5P activity attempts report",
"details": "The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.9"
},
{
"fixed": "3.9.17"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40316"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128151"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=438395"
}
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-862"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:43:22Z",
"nvd_published_at": "2022-09-30T17:15:00Z"
}
}
advisories/github-reviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json
+103
View File
@@ -0,0 +1,103 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mqw9-3cjm-xwp3",
"modified": "2024-04-23T23:43:17Z",
"published": "2022-10-01T00:00:20Z",
"aliases": [
"CVE-2022-40315"
],
"summary": "Moodle Minor SQL injection risk in admin user browsing",
"details": "A limited SQL injection risk was identified in the \"browse list of users\" site administration page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.9"
},
{
"fixed": "3.9.17"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.10"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40315"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128150"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=438394"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:43:17Z",
"nvd_published_at": "2022-09-30T17:15:00Z"
}
}
advisories/github-reviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json
+84
View File
@@ -0,0 +1,84 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xjr3-fwp9-9g96",
"modified": "2024-04-23T23:43:26Z",
"published": "2022-10-06T18:52:03Z",
"aliases": [
"CVE-2022-2986"
],
"summary": "Moodle Cross-Site Request Forgery (CSRF)",
"details": "Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.9"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2986"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2121360"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:43:26Z",
"nvd_published_at": "2022-10-06T18:16:00Z"
}
}
advisories/unreviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json → advisories/github-reviewed/2022/11/GHSA-6gx2-g773-hv9h/GHSA-6gx2-g773-hv9h.json
+65 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-6gx2-g773-hv9h",
"modified": "2022-11-26T06:31:18Z",
"modified": "2024-04-23T23:43:31Z",
"published": "2022-11-23T15:30:21Z",
"aliases": [
"CVE-2022-45150"
],
"summary": "Moodle reflected cross-site scripting vulnerability in policy tool",
"details": "A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.",
"severity": [
{
@@ -14,7 +15,63 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.9"
},
{
"fixed": "3.9.18"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.5"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +82,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142773"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2"
@@ -51,8 +112,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:43:31Z",
"nvd_published_at": "2022-11-23T15:15:00Z"
}
}
advisories/unreviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json → advisories/github-reviewed/2022/11/GHSA-xv72-6pgh-cjj8/GHSA-xv72-6pgh-cjj8.json
+46 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xv72-6pgh-cjj8",
"modified": "2022-11-26T06:31:17Z",
"modified": "2024-04-23T23:43:35Z",
"published": "2022-11-23T15:30:21Z",
"aliases": [
"CVE-2022-45151"
],
"summary": "Moodle stored-XSS vulnerability in some \"social\" user profile fields",
"details": "The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several \"social\" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.",
"severity": [
{
@@ -14,7 +15,44 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.11"
}
]
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "4.0"
},
{
"fixed": "4.0.5"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +63,10 @@
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2142774"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2DHYIIAUXUBHMBEDYU7TYNZXEN2W2SA2"
@@ -51,8 +93,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-23T23:43:35Z",
"nvd_published_at": "2022-11-23T15:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-332g-xh34-5c96/GHSA-332g-xh34-5c96.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-332g-xh34-5c96",
"modified": "2022-05-14T03:46:14Z",
"published": "2022-05-14T03:46:14Z",
"aliases": [
"CVE-2018-1044"
],
"details": "In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1044"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=364383"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/102754"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-01-22T08:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-54r2-r67g-fr9m/GHSA-54r2-r67g-fr9m.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-54r2-r67g-fr9m",
"modified": "2022-05-17T02:27:46Z",
"published": "2022-05-17T02:27:46Z",
"aliases": [
"CVE-2017-2642"
],
"details": "Moodle 3.x has user fullname disclosure on the user preferences page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2642"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=355554"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/99606"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-07-17T17:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rjh8-w8jg-xwq5/GHSA-rjh8-w8jg-xwq5.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rjh8-w8jg-xwq5",
"modified": "2022-05-17T00:18:11Z",
"published": "2022-05-17T00:18:11Z",
"aliases": [
"CVE-2017-15110"
],
"details": "In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15110"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=361784"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/101909"
}
],
"database_specific": {
"cwe_ids": [
"CWE-200"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-11-20T14:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-xhfw-wjjc-4j5h/GHSA-xhfw-wjjc-4j5h.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xhfw-wjjc-4j5h",
"modified": "2022-05-13T01:49:13Z",
"published": "2022-05-13T01:49:13Z",
"aliases": [
"CVE-2018-1136"
],
"details": "An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1136"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=371202"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/104307"
}
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-05-25T12:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-xhq3-455r-xv44/GHSA-xhq3-455r-xv44.json
-50
View File
@@ -1,50 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xhq3-455r-xv44",
"modified": "2022-05-17T02:12:39Z",
"published": "2022-05-17T02:12:39Z",
"aliases": [
"CVE-2017-2641"
],
"details": "In Moodle 2.x and 3.x, SQL injection can occur via user preferences.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-2641"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=349419"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/41828"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96977"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1038174"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-26T18:59:00Z"
}
}
advisories/unreviewed/2022/10/GHSA-2hmm-q272-xmhf/GHSA-2hmm-q272-xmhf.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-2hmm-q272-xmhf",
"modified": "2022-10-05T00:00:38Z",
"published": "2022-10-01T00:00:20Z",
"aliases": [
"CVE-2022-40314"
],
"details": "A remote code execution risk when restoring backup files originating from Moodle 1.9 was identified.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40314"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128147"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=438393"
}
],
"database_specific": {
"cwe_ids": [
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-30T17:15:00Z"
}
}
advisories/unreviewed/2022/10/GHSA-385f-vgq7-8hhx/GHSA-385f-vgq7-8hhx.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-385f-vgq7-8hhx",
"modified": "2022-10-05T00:00:38Z",
"published": "2022-10-01T00:00:20Z",
"aliases": [
"CVE-2022-40316"
],
"details": "The H5P activity attempts report did not filter by groups, which in separate groups mode could reveal information to non-editing teachers about attempts/users in groups they should not have access to.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40316"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128151"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=438395"
}
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-30T17:15:00Z"
}
}
advisories/unreviewed/2022/10/GHSA-mqw9-3cjm-xwp3/GHSA-mqw9-3cjm-xwp3.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mqw9-3cjm-xwp3",
"modified": "2022-10-05T00:00:38Z",
"published": "2022-10-01T00:00:20Z",
"aliases": [
"CVE-2022-40315"
],
"details": "A limited SQL injection risk was identified in the \"browse list of users\" site administration page.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40315"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2128150"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=438394"
}
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-30T17:15:00Z"
}
}
advisories/unreviewed/2022/10/GHSA-xjr3-fwp9-9g96/GHSA-xjr3-fwp9-9g96.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-xjr3-fwp9-9g96",
"modified": "2022-10-07T18:15:43Z",
"published": "2022-10-06T18:52:03Z",
"aliases": [
"CVE-2022-2986"
],
"details": "Enabling and disabling installed H5P libraries did not include the necessary token to prevent a CSRF risk.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2986"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2121360"
},
{
"type": "WEB",
"url": "http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-75326"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-06T18:16:00Z"
}
}