CVE-2018-1042

Moodle 3.x has Server Side Request Forgery in the filepicker...

Session fixation

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

CVE-2018-1044

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

CVE-2018-1045

In Moodle 3.x, there is XSS via a calendar event name...

CVE-2018-1044

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

CVE-2018-1043

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

Code injection

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

CVE-2018-1044

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

CVE-2018-1043

The data points to CVE-2018-1043 affecting Moodle 3.x: the blocked hosts list can be bypassed using multiple A-record hostnames. The related metrics indicate a CVSS v3 base score of 6.5 (I=High, A=None, C=None; network attack, low complexity, low privileges required, no user interaction). No expl...

CVE-2018-1044

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings...

CVE-2018-1042

Summary of CVE-2018-1042 (Moodle SSRF): Moodle 3.x is affected by a server-side request forgery in the filepicker. The underlying issue is an SSRF in the filepicker function, enabling an attacker (reported as authenticated) to issue requests from the vulnerable Moodle host, potentially probing in...

CVE-2018-1043

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames...

CVE-2018-1042

Moodle 3.x has Server Side Request Forgery in the filepicker...

CVE-2018-1044

CVE-2018-1044 affects Moodle 3.x where quiz web services expose quiz results to users when settings prohibit it. Documented impact is that authorized users could access results contrary to configuration; no explicit patch/version remediation is provided in the initial description. CVSS metrics sh...

CVE-2018-1045

In Moodle 3.x, there is XSS via a calendar event name...

EvilURL v2.0 - An Unicode Domain Phishing Generator for IDN Homograph Attack

Generate unicode evil domains for IDN Homograph Attack and detect them. PREREQUISITES python 3.x for evilurl3.py TESTED ON:Kali Linux - ROLLING EDITION CLONE git clone https://github.com/UndeadSec/EvilURL.git RUNNING cd EvilURL python3 evilurl.py CHANGELOG Full script updated to Python 3.x Python...

RHEL 7 : redhat-virtualization-host (RHSA-2018:0044) (Meltdown) (Spectre)

An update for redhat-virtualization-host is now available for RHEV 3.X Hypervisor and Agents for RHEL-7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

RHEL 7 : qemu-kvm-rhev (RHSA-2018:0028)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0028 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm-rhev packages provide the...

Joomla CMS Real Estate 1.5 SQL Injection

Title: Joomla! CMS Real Estate 1.5 - SQL injection Credit: Bilal KARDADOU Vendor: http://www.cms-realestate.com URL: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/cms-real-estate/ Product: 'Joomla! CMS Real Estate 1.5 - SQL injection' Developer: JoomlaUX Extensio...

Joomla JMultipleHotelReservation 6.0.5 SQL Injection

Title: Joomla JMultipleHotelReservation 6.0.5 - SQL injection Credit: Bilal KARDADOU Vendor: http://www.cmsjunkie.com/joomla-hotel-portal URL: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/jmultiplehotelreservation/ Product: 'Joomla...