Skip to content
OpenAdvisories

Archive

June 2015

Vulnerabilities first published in this month (UTC), newest first.

← May 2015 2015 / June July 2015 →
  1. 125
  2. 219
  3. 38
  4. 47
  5. 57
  6. 6 
  7. 716
  8. 814
  9. 926
  10. 1070
  11. 117
  12. 1216
  13. 1322
  14. 14 
  15. 1567
  16. 1615
  17. 1719
  18. 1816
  19. 1911
  20. 204
  21. 21 
  22. 2210
  23. 2316
  24. 2427
  25. 253
  26. 2611
  27. 272
  28. 2825
  29. 293
  30. 3029
All Critical High Medium Low Exploited only Public exploit

495 results · Feed

  • Unscored —
    CVE-2015-3177

    Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site…

  • Medium —
    CVE-2015-3181

    Moodle allows attackers to bypass file-management restrictions

    files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/user:manageownfiles capability before approving a private-file upload, which allows remote authenticated users to bypas…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-3180

    Moodle allows attackers to obtain sensitive course-structure information

    lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolm…

    moodle/moodle Packagist
  • Low —
    CVE-2015-3179

    Moodle allows attackers to bypass intended login restrictions

    login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.

    moodle/moodle Packagist
  • Low —
    CVE-2015-3178

    Moodle cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or H…

    moodle/moodle Packagist
  • Low —
    CVE-2015-3174

    Moodle does not set the RISK_XSS bit for graders

    mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradeb…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-3175

    Moodle Arbitrary Redirect

    Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page th…

    moodle/moodle Packagist
  • Low —
    CVE-2015-2273

    Moodle cross-site scripting (XSS) vulnerability

    Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HT…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-2266

    Moodle allows attackers to obtain sensitive personal-contact and unread-message-count information

    message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site:readallmessages capability before accessing arbitrary conversations, which allows remote authenticated users to obtain …

    moodle/moodle Packagist
  • Medium —
    CVE-2015-2268

    Moodle allows attackers to cause a denial of service

    filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to cause a denial of service (CPU consumption or partial outage) via a crafted string that is matched against…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-2271

    Moodle does not consider the moodle/tag:flag capability

    tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended…

    moodle/moodle Packagist
  • Low —
    CVE-2015-2269 Public exploit

    Moodle XSS Vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2…

    moodle/moodle Packagist
  • Medium —
    CVE-2015-2272

    Moodle allows attackers to bypass a forced-password-change requirement

    login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token.

    moodle/moodle Packagist
  • Medium —
    CVE-2015-2267

    Moodle allows attackers to extract archives to arbitrary directories

    mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass intended access restrictions and extract archives to arbitrary directories via a crafted dataroot value.

    moodle/moodle Packagist
  • Medium —
    CVE-2015-2270

    Moodle allows attackers to obtain sensitive course information

    lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-regions feature, establishes the course state at an incorrect point in the login-validation process, which allows remote …

    moodle/moodle Packagist