Skip to content
OpenAdvisories

Archive

27 May 2014

Vulnerabilities first published on this day (UTC), newest first.

← April 2014 2014 / May /27 June 2014 →
  1. 112
  2. 238
  3. 3 
  4. 4 
  5. 515
  6. 611
  7. 713
  8. 852
  9. 96
  10. 102
  11. 115
  12. 1221
  13. 1317
  14. 1465
  15. 158
  16. 1621
  17. 175
  18. 181
  19. 1927
  20. 2033
  21. 2114
  22. 2247
  23. 2325
  24. 246
  25. 253
  26. 2626
  27. 2726
  28. 282
  29. 2918
  30. 3025
  31. 316
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • Medium 4.4
    CVE-2014-0177

    Hub Package Arbitrary File Overwrite

    The am function in lib/hub/commands.rb in hub before 1.12.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary patch file.

    github.com/github/hub hub Go RubyGems
  • Medium —
    CVE-2014-3840 Public exploit

    Mayan EDMS multiple cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in apps/common/templates/calculate_form_title.html in Mayan EDMS 0.13 allow remote authenticated users to inject arbitrary web script or HTML via a (1) tag or the (2) title of a source in a Staging folder, (…

    mayan-edms PyPI
  • Medium —
    CVE-2014-0216

    Moodle does not properly restrict file access

    The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 does not properly restrict file access, which allows remote attackers to obtain s…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0215

    Moodle Reveals Student Information Meant To Be Anonymous

    The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading the HTML source.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0217

    Moodle does not check for the moodle/course:viewhiddencourses capability

    enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the …

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0218

    Moodle cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote attackers to inject arbitrary web script or HTML via un…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0213

    Moodle multiple cross-site request forgery (CSRF) vulnerabilities

    Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allow remote attackers to hijack the authentication of …

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0214

    Moodle creates a MoodleMobile web-service token with an infinite lifetime

    login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attac…

    moodle/moodle Packagist