Skip to content
OpenAdvisories

Archive

May 2016

Vulnerabilities first published in this month (UTC), newest first.

← April 2016 2016 / May June 2016 →
  1. 18
  2. 236
  3. 34
  4. 4 
  5. 525
  6. 67
  7. 718
  8. 8 
  9. 941
  10. 105
  11. 11156
  12. 125
  13. 1325
  14. 1425
  15. 153
  16. 1627
  17. 1713
  18. 184
  19. 191
  20. 2084
  21. 212
  22. 2240
  23. 2328
  24. 241
  25. 2513
  26. 2614
  27. 27 
  28. 283
  29. 292
  30. 307
  31. 3115
All Critical High Medium Low Exploited only Public exploit

19 results · Clear filters · Feed

  • Medium 6.1
    CVE-2016-2152

    Moodle XSS from profile fields from external db

    Multiple cross-site scripting (XSS) vulnerabilities in auth/db/auth.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via an externa…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2016-2156

    Moodle provides calendar-event data without considering whether an activity is hidden

    calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to …

    moodle/moodle moodle Ubuntu Packagist
  • Medium 4.3
    CVE-2016-2151

    Moodle allows attackers to discover student e-mail addresses

    user/index.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated u…

    moodle/moodle Packagist
  • Medium 5.3
    CVE-2016-2190

    Moodle sensitive information disclosure

    Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2016-2154

    Moodle allows attackers to discover hidden course names

    admin/tool/monitor/lib.php in Event Monitor in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to discover hidden course names by …

    moodle/moodle moodle Ubuntu Packagist
  • Medium 4.3
    CVE-2016-2155

    Moodle allows attackers to modify "Exclude grade" settings

    The grade-reporting feature in Singleview (aka Single View) in Moodle 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not consider the moodle/grade:manage capability, which allows remote authenticated users to modify "Exclude grade" setti…

    moodle/moodle moodle Ubuntu Packagist
  • Medium 4.3
    CVE-2016-2158

    Moodle allows attackers to obtain sensitive category-detail information

    lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the …

    moodle/moodle moodle Ubuntu Packagist
  • Medium 6.1
    CVE-2016-2153

    Moodle Reflected XSS in mod_data advanced search

    Cross-site scripting (XSS) vulnerability in the advanced-search feature in mod_data in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to inject arbitrary web script or HTML v…

    moodle/moodle Packagist
  • Medium 4.3
    CVE-2016-2159

    Moodle External function mod_assign_save_submission does not check due dates

    The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging …

    moodle/moodle Packagist
  • Medium 6.1
    CVE-2016-4567

    MediaElement Vulnerable to Reflected XSS

    Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, …

    contao/core mediaelement mediaelement mediaelement Debian Ubuntu npm Packagist
  • Medium 6.5
    CVE-2016-4425

    Jansson 2.7 and earlier allows context-dependent attackers to cause a denial of service (deep recursion, stack consumpt…

    jansson jansson Debian Ubuntu
  • Medium 4.3
    CVE-2016-3725

    Missing permissions check in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service …

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3722

    Incorrect Authorization in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3727

    Jenkins Exposes Sensitive Information via API URL

    The API URL computer/(master)/api/xml in Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users with extended read permission for the master node to obtain sensitive information about the global configuration via unspecified vectors.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 6.5
    CVE-2016-3724

    Jenkins Exposes Sensitive Information from Job Configuration

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with extended read access to obtain sensitive password information by reading a job configuration.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3723

    Exposure of Sensitive Information in Jenkins Core

    Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 4.3
    CVE-2016-3721

    Jenkins allows Remote Users to Inject Build Parameters

    Jenkins before 2.3 and LTS before 1.651.2 might allow remote authenticated users to inject arbitrary build parameters into the build environment via environment variables.

    org.jenkins-ci.main:jenkins-core Maven
  • Medium 5.5
    CVE-2016-3715 Exploited Public exploit EPSS 75%

    The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary f…

    imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu
    KEV Nov 3, 2021
  • Medium 5.5
    CVE-2016-3718 Exploited Public exploit EPSS 76%

    The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct…

    imagemagick imagemagick graphicsmagick graphicsmagick Debian Ubuntu
    KEV Nov 3, 2021