CVE-2011-4284

Concrete details available: CVE-2011-4284 affects Moodle 2.0.x prior to 2.0.2, where the myprofile block can disclose sensitive information when a user-context page is visited. The root cause is exposure via the myprofile block, enabling remote attackers to obtain partial confidential data. Docum...

CVE-2011-4296

CVE-2011-4296 concerns Moodle where lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, allowing remote authenticated users to modify course filters by leveraging this role. Affected versions: Moodle 2.0.x up to 2.0.3; M...

CVE-2011-4278

Cross-site scripting XSS vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4293

The Moodle vulnerability CVE-2011-4293 affects Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1, where the theme implementation dupes caching of CSS and JavaScript content. This duplication can bypass access restrictions and allow writing to the operating system’s temporary directory via unspecif...

CVE-2011-4297

CVE-2011-4297 affects Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1. The flaw in the file comment/lib.php fails to properly restrict comment capabilities, allowing remote attackers to post a comment by leveraging the guest role on a front-page activity. The available connected documents confir...

CVE-2011-4278

The vulnerability is an XSS flaw in Moodle’s tag autocomplete feature. Affected products: Moodle 1.9.x before 1.9.11 and Moodle 2.0.x before 2.0.2. Root cause: the tag autocomplete code path allows injection of arbitrary web script or HTML via unspecified vectors. Impact: remote attackers could e...

CVE-2011-4283

The CVE refers to Moodle prior to 1.9.11 and 2.0.x prior to 2.0.2, where an IMS enterprise enrolment file is placed in the course-files area, allowing remote attackers to retrieve imsenterprise-enrol.xml and obtain sensitive information. Concretely, affected software: Moodle 1.9.x up to 1.9.11 an...

CVE-2011-4279

Summary (CVE-2011-4279) : Moodle 2.0.x before 2.0.2 does not apply the forceloginforprofiles setting to course-profiles access control, which can allow remote attackers to access potentially sensitive information via search-engine-enabled vectors (e.g., Google, Yahoo, Yandex). Affected product/ve...

CVE-2011-4280

Cross-site scripting XSS vulnerability in the Spike PHPCoverage aka spikephpcoverage library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

RedHat Update for kernel RHSA-2012:1061-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for pidgin FEDORA-2012-10294

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for clamav FEDORA-2012-9577

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Hastymail 2.1.1 RC1 Command Injection

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Hastymail 2.1.1 R...

VMSA-2012-0012 : VMware ESXi update to third-party library

a. ESXi update to third-party component libxml2 The libxml2 third-party library has been updated which addresses multiple security issues. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2010-4008, CVE-2011-0216, CVE-2011-1944, CVE-2011-2834, CVE-2011-390...

CVE-2011-4542

creationtimestamp| type| source ---|---|--- 2012-07-12 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/19758 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/hastymailexec.rb 2025-02-06 03:13:40+00:00| seen|...

Hastymail 2.1.1 RC1 - Command Injection (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 "Hastymail 2.1.1 R...

CVE-2011-4304

The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation...

CVE-2011-4308

mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors...

CVE-2011-4305

message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service infinite request loop via a URL that specifies a zero wait time for message refreshing...

CVE-2011-4301

The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant...