CVE-2014-0217

enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL...

CVE-2014-0217

enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to obtain sensitive name and summary information about these courses by leveraging the guest role and visiting a crafted URL...

Debian: Security Advisory (DSA-2928-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2012-6643

Multiple SQL injection vulnerabilities in the updatecounter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to 1 videos.php or 2 channels.php. NOTE: some of these details are obtained from third party information...

Sql injection

Multiple SQL injection vulnerabilities in the updatecounter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to 1 videos.php or 2 channels.php. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in ClipBucket 2.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter to viewchannel.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter to channels.php, 2 collections.php, 3 groups.php, or 4 videos.php; 5 query parameter to searchresult.php; or 6 type parameter to...

CVE-2012-6644

Multiple cross-site scripting XSS vulnerabilities in ClipBucket 2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 cat parameter to channels.php, 2 collections.php, 3 groups.php, or 4 videos.php; 5 query parameter to searchresult.php; or 6 type parameter to...

CVE-2012-6643

Multiple SQL injection vulnerabilities in the updatecounter function in includes/functions.php in ClipBucket 2.6 allow remote attackers to execute arbitrary SQL commands via the time parameter to 1 videos.php or 2 channels.php. NOTE: some of these details are obtained from third party information...

CVE-2012-6642

The CVE-2012-6642 entry concerns ClipBucket 2.6 with a Cross-site Scripting (XSS) flaw allowing remote attackers to inject arbitrary web script or HTML via the type parameter to view_channel.php. The vulnerability is supported by multiple feeds (NVD, Red Hat advisory, OpenVAS) and is described wi...

CVE-2012-6643

CVE-2012-6643 affects ClipBucket 2.6, where the update_counter function in includes/functions.php is vulnerable to SQL injection. An attacker can pass a crafted time parameter via videos.php or channels.php to cause arbitrary SQL execution. The OpenVAS entry corroborates multiple vulnerabilities ...

CVE-2012-6644

ClipBucket 2.6 is reported to be affected by multiple cross-site scripting (XSS) vulnerabilities. The issue allows remote attackers to inject arbitrary web script or HTML via several parameters across different pages: (1) cat in channels.php, (2) collections.php, (3) groups.php, (4) videos.php, (...

Fedora 20 : jansson-2.6-1.fc20 (2014-3778)

Florian Weimer of the Red Hat Product Security Team found that the hashing implementation in Jansson, a library for encoding, decoding and manipulating JSON data, was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause an application using Jansson to use an...

CVE-2014-2572

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors...

Code injection

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by 1 providing a crafted playerId or 2 referencing a...

Code injection

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

Design/Logic Flaw

repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner...

[SECURITY] Fedora 19 Update: jansson-2.6-1.fc19

Small library for parsing and writing JSON documents...

CVE-2014-0129

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors...