Skip to content
OpenAdvisories

Archive

22 May 2016

Vulnerabilities first published on this day (UTC), newest first.

← April 2016 2016 / May /22 June 2016 →
  1. 18
  2. 236
  3. 34
  4. 4 
  5. 525
  6. 67
  7. 718
  8. 8 
  9. 941
  10. 105
  11. 11156
  12. 125
  13. 1325
  14. 1425
  15. 153
  16. 1627
  17. 1713
  18. 184
  19. 191
  20. 2084
  21. 212
  22. 2240
  23. 2328
  24. 241
  25. 2513
  26. 2614
  27. 27 
  28. 283
  29. 292
  30. 307
  31. 3115
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.1
    CVE-2016-2152

    Moodle XSS from profile fields from external db

    Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an externa…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2016-2156

    Moodle provides calendar-event data without considering whether an activity is hidden

    calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to …

    moodle/moodle moodle Ubuntu Packagist
  • Medium 4.3
    CVE-2016-2151

    Moodle allows attackers to discover student e-mail addresses

    user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated u…

    moodle/moodle Packagist
  • Medium 5.3
    CVE-2016-2190

    Moodle sensitive information disclosure

    Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2016-2154

    Moodle allows attackers to discover hidden course names

    admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by …

    moodle/moodle moodle Ubuntu Packagist
  • Medium 4.3
    CVE-2016-2155

    Moodle allows attackers to modify "Exclude grade" settings

    The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" setti…

    moodle/moodle moodle Ubuntu Packagist
  • Medium 4.3
    CVE-2016-2158

    Moodle allows attackers to obtain sensitive category-detail information

    lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the …

    moodle/moodle moodle Ubuntu Packagist
  • Medium 6.1
    CVE-2016-2153

    Moodle Reflected XSS in mod_data advanced search

    Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML v…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2016-2159

    Moodle External function mod_assign_save_submission does not check due dates

    The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging …

    moodle/moodle Packagist
  • Medium 6.1
    CVE-2016-4567

    MediaElement Vulnerable to Reflected XSS

    Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, …

    contao/core mediaelement mediaelement contao-components/mediaelement Debian Ubuntu npm Packagist