22 May 2016

40 results · Feed

• Medium 6.1
  CVE-2016-2152

  Moodle XSS from profile fields from external db

  Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an externa…

  moodle/moodle Packagist
  May 22, 2016
• Medium 4.3
  CVE-2016-2156

  Moodle provides calendar-event data without considering whether an activity is hidden

  calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to …

  moodle/moodle moodle Ubuntu Packagist
  May 22, 2016
• Medium 4.3
  CVE-2016-2151

  Moodle allows attackers to discover student e-mail addresses

  user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated u…

  moodle/moodle Packagist
  May 22, 2016
• Medium 5.3
  CVE-2016-2190

  Moodle sensitive information disclosure

  Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

  moodle/moodle Packagist
  May 22, 2016
• High 8.8
  CVE-2016-2157

  Moodle cross-site request forgery (CSRF) vulnerability

  Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of adminis…

  moodle/moodle moodle Ubuntu Packagist
  May 22, 2016
• Medium 4.3
  CVE-2016-2154

  Moodle allows attackers to discover hidden course names

  admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by …

  moodle/moodle moodle Ubuntu Packagist
  May 22, 2016
• Medium 4.3
  CVE-2016-2155

  Moodle allows attackers to modify "Exclude grade" settings

  The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" setti…

  moodle/moodle moodle Ubuntu Packagist
  May 22, 2016
• Medium 4.3
  CVE-2016-2158

  Moodle allows attackers to obtain sensitive category-detail information

  lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the …

  moodle/moodle moodle Ubuntu Packagist
  May 22, 2016
• Medium 6.1
  CVE-2016-2153

  Moodle Reflected XSS in mod_data advanced search

  Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML v…

  moodle/moodle Packagist
  May 22, 2016
• Medium 4.3
  CVE-2016-2159

  Moodle External function mod_assign_save_submission does not check due dates

  The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging …

  moodle/moodle Packagist
  May 22, 2016
• Unscored —
  CVE-2015-7989

  Cross-site scripting (XSS) vulnerability in the user list table in WordPress before 4.3.1 allows remote authenticated u…

  wordpress Debian
  May 22, 2016
• Unscored —
  CVE-2015-8867

  The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x …

  php5 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2015-8879

  The odbc_bindcols function in ext/odbc/php_odbc.c in PHP before 5.6.12 mishandles driver behavior for SQL_WVARCHAR colu…

  php5 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2015-8876

  Zend/zend_exceptions.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 does not validate certain Exc…

  php5 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2015-8878

  main/php_open_temporary_file.c in PHP before 5.5.28 and 5.6.x before 5.6.12 does not ensure thread safety, which allows…

  May 22, 2016
• Unscored —
  CVE-2015-8877

  The gdImageScaleTwoPass function in gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.0, as used in …

  libgd2 libgd2 Debian Ubuntu
  May 22, 2016
• Unscored —
  CVE-2015-8834

  Cross-site scripting (XSS) vulnerability in wp-includes/wp-db.php in WordPress before 4.2.2 allows remote attackers to …

  wordpress Debian
  May 22, 2016
• Unscored —
  CVE-2015-8880

  Double free vulnerability in the format printer in PHP 7.x before 7.0.1 allows remote attackers to have an unspecified …

  May 22, 2016
• Unscored —
  CVE-2015-8866

  ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread fro…

  php5 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2015-5714

  Cross-site scripting (XSS) vulnerability in WordPress before 4.3.1 allows remote attackers to inject arbitrary web scri…

  wordpress Debian
  May 22, 2016
• Unscored —
  CVE-2015-5715

  The mw_editPost function in wp-includes/class-wp-xmlrpc-server.php in the XMLRPC subsystem in WordPress before 4.3.1 al…

  wordpress Debian
  May 22, 2016
• Unscored —
  CVE-2014-9767

  Directory traversal vulnerability in the ZipArchive::extractTo function in ext/zip/php_zip.c in PHP before 5.4.45, 5.5.…

  php5 hhvm Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-1564

  Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/class-wp-theme.php in WordPress before 4.4.1 allow r…

  wordpress Debian
  May 22, 2016
• Unscored —
  CVE-2016-4544

  The exif_process_TIFF_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0…

  php5 php7.0 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4538

  The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 modifies c…

  php5 php7.0 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4566

  Cross-site scripting (XSS) vulnerability in plupload.flash.swf in Plupload before 2.1.9, as used in WordPress before 4.…

  wordpress wordpress Debian Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4539

  The xml_parse_into_struct function in ext/xml/xml.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 all…

  php5 php7.0 Ubuntu
  May 22, 2016
• Medium 6.1
  CVE-2016-4567

  MediaElement Vulnerable to Reflected XSS

  Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, …

  contao/core mediaelement mediaelement mediaelement Debian Ubuntu npm Packagist
  May 22, 2016
• Unscored —
  CVE-2016-4537

  The bcpowmod function in ext/bcmath/bcmath.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 accepts a …

  php5 php7.0 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4342

  ext/phar/phar_object.c in PHP before 5.5.32, 5.6.x before 5.6.18, and 7.x before 7.0.3 mishandles zero-length uncompres…

  php5 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4541

  The grapheme_strpos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x …

  php5 php7.0 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4542

  The exif_process_IFD_TAG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.6 do…

  php5 php7.0 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4344

  Integer overflow in the xml_utf8_encode function in ext/xml/xml.c in PHP before 7.0.4 allows remote attackers to cause …

  May 22, 2016
• Unscored —
  CVE-2016-4543 EPSS 12%

  The exif_process_IFD_in_JPEG function in ext/exif/exif.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x before 7.0.…

  php5 php7.0 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4540

  The grapheme_stripos function in ext/intl/grapheme/grapheme_string.c in PHP before 5.5.35, 5.6.x before 5.6.21, and 7.x…

  php5 php7.0 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4345

  Integer overflow in the php_filter_encode_url function in ext/filter/sanitizing_filters.c in PHP before 7.0.4 allows re…

  May 22, 2016
• Unscored —
  CVE-2016-4343

  The phar_make_dirstream function in ext/phar/dirstream.c in PHP before 5.6.18 and 7.x before 7.0.3 mishandles zero-size…

  php5 Ubuntu
  May 22, 2016
• Unscored —
  CVE-2016-4346

  Integer overflow in the str_pad function in ext/standard/string.c in PHP before 7.0.4 allows remote attackers to cause …

  May 22, 2016
• Unscored —
  CVE-2016-2222

  The wp_http_validate_url function in wp-includes/http.php in WordPress before 4.4.2 allows remote attackers to conduct …

  wordpress Debian
  May 22, 2016
• Unscored —
  CVE-2016-2221

  Open redirect vulnerability in the wp_validate_redirect function in wp-includes/pluggable.php in WordPress before 4.4.2…

  wordpress Debian
  May 22, 2016