From fb5e3eaa2dee0f59d68e923d977dc4a773c7dee3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Sat, 12 Apr 2025 02:35:45 +0000 Subject: [PATCH] Publish Advisories GHSA-3qg4-2fcm-c8f9 GHSA-7cvw-wrj9-q5fp GHSA-fhgh-fjh9-vq62 GHSA-frv8-xjcp-hrm2 GHSA-h6px-pvfh-q2jv GHSA-m2pf-4pf8-45j2 GHSA-m3xp-4hf3-qfpp GHSA-h6px-pvfh-q2jv GHSA-m3xp-4hf3-qfpp --- .../GHSA-3qg4-2fcm-c8f9.json | 44 +++++++-- .../GHSA-7cvw-wrj9-q5fp.json | 40 +++++++- .../GHSA-fhgh-fjh9-vq62.json | 40 +++++++- .../GHSA-frv8-xjcp-hrm2.json | 48 +++++++--- .../GHSA-h6px-pvfh-q2jv.json | 92 +++++++++++++++++++ .../GHSA-m2pf-4pf8-45j2.json | 44 +++++++-- .../GHSA-m3xp-4hf3-qfpp.json | 92 +++++++++++++++++++ .../GHSA-h6px-pvfh-q2jv.json | 43 --------- .../GHSA-m3xp-4hf3-qfpp.json | 43 --------- 9 files changed, 365 insertions(+), 121 deletions(-) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-3qg4-2fcm-c8f9/GHSA-3qg4-2fcm-c8f9.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-7cvw-wrj9-q5fp/GHSA-7cvw-wrj9-q5fp.json (59%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-fhgh-fjh9-vq62/GHSA-fhgh-fjh9-vq62.json (56%) rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-frv8-xjcp-hrm2/GHSA-frv8-xjcp-hrm2.json (65%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json rename advisories/{unreviewed => github-reviewed}/2022/05/GHSA-m2pf-4pf8-45j2/GHSA-m2pf-4pf8-45j2.json (54%) create mode 100644 advisories/github-reviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json delete mode 100644 advisories/unreviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json diff --git a/advisories/unreviewed/2022/05/GHSA-3qg4-2fcm-c8f9/GHSA-3qg4-2fcm-c8f9.json b/advisories/github-reviewed/2022/05/GHSA-3qg4-2fcm-c8f9/GHSA-3qg4-2fcm-c8f9.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-3qg4-2fcm-c8f9/GHSA-3qg4-2fcm-c8f9.json rename to advisories/github-reviewed/2022/05/GHSA-3qg4-2fcm-c8f9/GHSA-3qg4-2fcm-c8f9.json index d2452b9c6f9..6662718185d 100644 --- a/advisories/unreviewed/2022/05/GHSA-3qg4-2fcm-c8f9/GHSA-3qg4-2fcm-c8f9.json +++ b/advisories/github-reviewed/2022/05/GHSA-3qg4-2fcm-c8f9/GHSA-3qg4-2fcm-c8f9.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-3qg4-2fcm-c8f9", - "modified": "2025-04-11T03:59:16Z", + "modified": "2025-04-12T02:34:33Z", "published": "2022-05-13T01:13:18Z", "aliases": [ "CVE-2011-4289" ], + "summary": "Moodle does not recogniz configuration setting that makes e-mail addresses visible only to course members", "details": "Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4289" }, + { + "type": "PACKAGE", + "url": "http://git.moodle.org" + }, { "type": "WEB", "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=181991e791a13a3c383234718c26c499e31d3df1" @@ -32,10 +62,12 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-200" + ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:34:33Z", "nvd_published_at": "2012-07-16T10:28:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-7cvw-wrj9-q5fp/GHSA-7cvw-wrj9-q5fp.json b/advisories/github-reviewed/2022/05/GHSA-7cvw-wrj9-q5fp/GHSA-7cvw-wrj9-q5fp.json similarity index 59% rename from advisories/unreviewed/2022/05/GHSA-7cvw-wrj9-q5fp/GHSA-7cvw-wrj9-q5fp.json rename to advisories/github-reviewed/2022/05/GHSA-7cvw-wrj9-q5fp/GHSA-7cvw-wrj9-q5fp.json index ebedb613b82..477baec6db2 100644 --- a/advisories/unreviewed/2022/05/GHSA-7cvw-wrj9-q5fp/GHSA-7cvw-wrj9-q5fp.json +++ b/advisories/github-reviewed/2022/05/GHSA-7cvw-wrj9-q5fp/GHSA-7cvw-wrj9-q5fp.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-7cvw-wrj9-q5fp", - "modified": "2025-04-11T03:59:16Z", + "modified": "2025-04-12T02:33:12Z", "published": "2022-05-13T01:13:08Z", "aliases": [ "CVE-2011-4133" ], + "summary": "Moodle vulnerable to Cross-Site Request Forgery", "details": "Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9.0" + }, + { + "fixed": "1.9.11" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4133" }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, { "type": "WEB", "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=8f031d5431c1204197b1482fd6c63bc87a19a476" @@ -36,8 +66,8 @@ "CWE-352" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:33:12Z", "nvd_published_at": "2012-07-16T10:28:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-fhgh-fjh9-vq62/GHSA-fhgh-fjh9-vq62.json b/advisories/github-reviewed/2022/05/GHSA-fhgh-fjh9-vq62/GHSA-fhgh-fjh9-vq62.json similarity index 56% rename from advisories/unreviewed/2022/05/GHSA-fhgh-fjh9-vq62/GHSA-fhgh-fjh9-vq62.json rename to advisories/github-reviewed/2022/05/GHSA-fhgh-fjh9-vq62/GHSA-fhgh-fjh9-vq62.json index 15a8f47a61a..d6d66db19d1 100644 --- a/advisories/unreviewed/2022/05/GHSA-fhgh-fjh9-vq62/GHSA-fhgh-fjh9-vq62.json +++ b/advisories/github-reviewed/2022/05/GHSA-fhgh-fjh9-vq62/GHSA-fhgh-fjh9-vq62.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-fhgh-fjh9-vq62", - "modified": "2025-04-11T03:59:16Z", + "modified": "2025-04-12T02:32:59Z", "published": "2022-05-13T01:13:18Z", "aliases": [ "CVE-2011-4292" ], + "summary": "Moodle allows remote authenticated users to cause a denial of service (invalid database records)", "details": "Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted comments operations.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4292" }, + { + "type": "PACKAGE", + "url": "http://git.moodle.org" + }, { "type": "WEB", "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=acb4688d29a7cc028803ee3d81edc7f1b6515c64" @@ -36,8 +66,8 @@ "CWE-89" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:32:59Z", "nvd_published_at": "2012-07-16T10:28:00Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-frv8-xjcp-hrm2/GHSA-frv8-xjcp-hrm2.json b/advisories/github-reviewed/2022/05/GHSA-frv8-xjcp-hrm2/GHSA-frv8-xjcp-hrm2.json similarity index 65% rename from advisories/unreviewed/2022/05/GHSA-frv8-xjcp-hrm2/GHSA-frv8-xjcp-hrm2.json rename to advisories/github-reviewed/2022/05/GHSA-frv8-xjcp-hrm2/GHSA-frv8-xjcp-hrm2.json index aaf234da176..501acbc362e 100644 --- a/advisories/unreviewed/2022/05/GHSA-frv8-xjcp-hrm2/GHSA-frv8-xjcp-hrm2.json +++ b/advisories/github-reviewed/2022/05/GHSA-frv8-xjcp-hrm2/GHSA-frv8-xjcp-hrm2.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-frv8-xjcp-hrm2", - "modified": "2025-04-11T03:38:47Z", + "modified": "2025-04-12T02:34:11Z", "published": "2022-05-17T05:48:25Z", "aliases": [ "CVE-2010-2958" ], + "summary": "phpMyAdmin Cross-site Scripting vulnerability", "details": "Cross-site scripting (XSS) vulnerability in libraries/Error.class.php in phpMyAdmin 3.x before 3.3.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to a PHP backtrace and error messages (aka debugging messages), a different vulnerability than CVE-2010-3056.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "phpmyadmin/phpmyadmin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.3.6" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2958" }, + { + "type": "PACKAGE", + "url": "https://github.com/phpmyadmin/composer" + }, { "type": "WEB", "url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin%3Ba=commit%3Bh=133a77fac7d31a38703db2099a90c1b49de62e37" @@ -22,10 +52,6 @@ "type": "WEB", "url": "http://phpmyadmin.git.sourceforge.net/git/gitweb.cgi?p=phpmyadmin/phpmyadmin;a=commit;h=133a77fac7d31a38703db2099a90c1b49de62e37" }, - { - "type": "WEB", - "url": "http://secunia.com/advisories/41206" - }, { "type": "WEB", "url": "http://www.openwall.com/lists/oss-security/2010/09/01/2" @@ -37,10 +63,6 @@ { "type": "WEB", "url": "http://www.phpmyadmin.net/home_page/security/PMASA-2010-6.php" - }, - { - "type": "WEB", - "url": "http://www.vupen.com/english/advisories/2010/2242" } ], "database_specific": { @@ -48,8 +70,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:34:11Z", "nvd_published_at": "2010-09-08T20:00:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json b/advisories/github-reviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json new file mode 100644 index 00000000000..e56145d145f --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-h6px-pvfh-q2jv", + "modified": "2025-04-12T02:32:27Z", + "published": "2022-05-13T01:13:15Z", + "aliases": [ + "CVE-2011-4299" + ], + "summary": "Moodle vulnerable to Cross-Site Scripting", + "details": "Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.1.0" + }, + { + "fixed": "2.1.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4299" + }, + { + "type": "WEB", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=747444" + }, + { + "type": "PACKAGE", + "url": "https://git.moodle.org" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=a459fd90625ae44d7b3ac10b65da2dc631a418e7" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git;a=commit;h=a459fd90625ae44d7b3ac10b65da2dc631a418e7" + }, + { + "type": "WEB", + "url": "http://moodle.org/mod/forum/discuss.php?d=188310" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-79" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:32:27Z", + "nvd_published_at": "2012-07-11T10:26:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m2pf-4pf8-45j2/GHSA-m2pf-4pf8-45j2.json b/advisories/github-reviewed/2022/05/GHSA-m2pf-4pf8-45j2/GHSA-m2pf-4pf8-45j2.json similarity index 54% rename from advisories/unreviewed/2022/05/GHSA-m2pf-4pf8-45j2/GHSA-m2pf-4pf8-45j2.json rename to advisories/github-reviewed/2022/05/GHSA-m2pf-4pf8-45j2/GHSA-m2pf-4pf8-45j2.json index 7ea58ccf00d..9cd5d8b8d90 100644 --- a/advisories/unreviewed/2022/05/GHSA-m2pf-4pf8-45j2/GHSA-m2pf-4pf8-45j2.json +++ b/advisories/github-reviewed/2022/05/GHSA-m2pf-4pf8-45j2/GHSA-m2pf-4pf8-45j2.json @@ -1,19 +1,49 @@ { "schema_version": "1.4.0", "id": "GHSA-m2pf-4pf8-45j2", - "modified": "2025-04-11T03:59:16Z", + "modified": "2025-04-12T02:34:48Z", "published": "2022-05-13T01:13:18Z", "aliases": [ "CVE-2011-4291" ], + "summary": "Moodle allows remote authenticated users to cause a denial of service (invalid database records)", "details": "Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service (invalid database records) via a series of crafted ratings operations.", - "severity": [], - "affected": [], + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.3" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4291" }, + { + "type": "PACKAGE", + "url": "http://git.moodle.org" + }, { "type": "WEB", "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=34b5e856b0c98aab3f5317119093628df0834957" @@ -32,10 +62,12 @@ } ], "database_specific": { - "cwe_ids": [], + "cwe_ids": [ + "CWE-20" + ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:34:48Z", "nvd_published_at": "2012-07-16T10:28:00Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json b/advisories/github-reviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json new file mode 100644 index 00000000000..138b7b24235 --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-m3xp-4hf3-qfpp", + "modified": "2025-04-12T02:33:23Z", + "published": "2022-05-13T01:13:09Z", + "aliases": [ + "CVE-2011-4283" + ], + "summary": "Moodle allows remote attackers to obtain sensitive information", + "details": "Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.9.0" + }, + { + "fixed": "1.9.11" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "moodle/moodle" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.0.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4283" + }, + { + "type": "PACKAGE", + "url": "https://github.com/moodle/moodle" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=6fde0dac702b3d0954bd1c34d427944e9cd89ae6" + }, + { + "type": "WEB", + "url": "http://git.moodle.org/gw?p=moodle.git;a=commit;h=6fde0dac702b3d0954bd1c34d427944e9cd89ae6" + }, + { + "type": "WEB", + "url": "http://moodle.org/mod/forum/discuss.php?d=170009" + }, + { + "type": "WEB", + "url": "http://openwall.com/lists/oss-security/2011/11/14/1" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-04-12T02:33:23Z", + "nvd_published_at": "2012-07-16T10:28:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json b/advisories/unreviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json deleted file mode 100644 index 3ffdd4e7ffe..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-h6px-pvfh-q2jv/GHSA-h6px-pvfh-q2jv.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-h6px-pvfh-q2jv", - "modified": "2025-04-11T03:59:08Z", - "published": "2022-05-13T01:13:15Z", - "aliases": [ - "CVE-2011-4299" - ], - "details": "Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4299" - }, - { - "type": "WEB", - "url": "https://bugzilla.redhat.com/show_bug.cgi?id=747444" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=a459fd90625ae44d7b3ac10b65da2dc631a418e7" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git;a=commit;h=a459fd90625ae44d7b3ac10b65da2dc631a418e7" - }, - { - "type": "WEB", - "url": "http://moodle.org/mod/forum/discuss.php?d=188310" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-79" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2012-07-11T10:26:00Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json b/advisories/unreviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json deleted file mode 100644 index 65211e07dae..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-m3xp-4hf3-qfpp/GHSA-m3xp-4hf3-qfpp.json +++ /dev/null @@ -1,43 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-m3xp-4hf3-qfpp", - "modified": "2025-04-11T03:59:16Z", - "published": "2022-05-13T01:13:09Z", - "aliases": [ - "CVE-2011-4283" - ], - "details": "Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.", - "severity": [], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-4283" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=6fde0dac702b3d0954bd1c34d427944e9cd89ae6" - }, - { - "type": "WEB", - "url": "http://git.moodle.org/gw?p=moodle.git;a=commit;h=6fde0dac702b3d0954bd1c34d427944e9cd89ae6" - }, - { - "type": "WEB", - "url": "http://moodle.org/mod/forum/discuss.php?d=170009" - }, - { - "type": "WEB", - "url": "http://openwall.com/lists/oss-security/2011/11/14/1" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-200" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2012-07-16T10:28:00Z" - } -} \ No newline at end of file