CVE-2012-6104

blog/rsslib.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allows remote attackers to obtain sensitive information from site-level blogs by leveraging the guest role and reading an RSS feed...

CVE-2012-6105

CVE-2012-6105 affects Moodle: blog/rsslib.php continues to expose the blog RSS feed after blogging is disabled across Moodle 2.1.x < 2.1.10, 2.2.x < 2.2.7, 2.3.x < 2.3.4, and 2.4.x

CVE-2012-6102

lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission comments aka feedback comments of arbitrary users via a crafted URI...

CVE-2012-6106

calendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x before 2.4.1 omits a capability check, which allows remote authenticated users to remove course-level calendar subscriptions by leveraging the student role and sending an iCalendar object...

CVE-2012-6112

The CVE-2012-6112 issue affects the PHP Spellchecker (Google Spellchecker) addon for TinyMCE, specifically the classes/GoogleSpell.php file in versions before 2.0.6.1. In Moodle deployments (2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, 2.4.x before 2.4.1) and other products, the c...

CVE-2012-6105

blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by reading this feed...

CVE-2012-6099

The CVE-2012-6099 issue affects Moodle’s moodle1 backup converter in backup/converter/moodle1/lib.php. The root cause is improper validation of pathnames, enabling remote authenticated users to read arbitrary files by abusing the backup-restoration feature. Affected versions are Moodle 2.1.x befo...

CVE-2012-6106

CVE-2012-6106 affects Moodle 2.4.x (before 2.4.1). The issue is an omitted capability check in calendar/managesubscriptions.php, allowing remote authenticated users (via the student role) to remove course-level calendar subscriptions by sending an iCalendar object. Connected sources confirm the a...

CVE-2012-6102

The CVE-2012-6102 issue affects Moodle’s Assignment module: specifically the Submissions comments plugin (lib.php). It allows remote attackers to read or modify any user’s submission comments (feedback comments) via a crafted URI in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1. The root cause...

CVE-2012-6103

CVE-2012-6103 affects Moodle’s messaging system (user/messageselect.php) across Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1. The vulnerability is a set of cross-site request forgery (CSRF) flaws that allow remote attackers to hijack the authentication of arbitrary users ...

CVE-2012-6101

CVE-2012-6101 describes multiple open redirect vulnerabilities in Moodle across 2.2.x (pre-2.2.7), 2.3.x (pre-2.3.4), and 2.4.x (pre-2.4.1). The underlying issue is insufficient validation of return/redirect URLs on several pages, enabling remote attackers to redirect victims to arbitrary sites a...

CVE-2012-6098

CVE-2012-6098 affects Moodle: grade/edit/outcome/edit_form.php where the moodle/grade:manage capability is not properly enforced. From Moodle 1.9.x (1.9.19) and 2.1.x up to 2.1.10, 2.2.x up to 2.2.7, 2.3.x up to 2.3.4, and 2.4.x up to 2.4.1, remote authenticated users with a teacher role can conv...

CVE-2012-6112

classes/GoogleSpell.php in the PHP Spellchecker aka Google Spellchecker addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote...

CVE-2012-5484

The CVE-2012-5484 issue affects FreeIPA 2.x and 3.x prior to 3.1.2 where the client fails to correctly obtain the CA certificate from the server, enabling a man-in-the-middle during the join procedure via a crafted certificate. Connected advisories indicate mitigations implemented in IPA client u...

SEC Consult SA-20130122-0 :: F5 BIG-IP XML External Entity Injection vulnerability

SEC Consult Vulnerability Lab Security Advisory 20130122-0 ======================================================================= title: XML External Entity Injection XXE product: F5 BIG-IP vulnerable version: =11.2.0 fixed version: 11.2.0 HF3 11.2.1 HF3 CVE number: CVE-2012-2997 impact: Medium...

[SECURITY] [DSA 2612-1] ircd-ratbox security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2612-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff January 24, 2013 http://www.debian.org/security/faq -...

[USN-1701-1] Vino vulnerability

========================================================================== Ubuntu Security Notice USN-1701-1 January 22, 2013 vino vulnerability ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubun...

[security bulletin] HPSBMU02841 SSRT100724 rev.1 - HP Diagnostics Server, Remote Execution of Arbitrary Code

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20566.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03645497 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03645497 Version: 1 HPSBMU02841...

CVE-2012-4914

Stack-based buffer overflow in the reader in CoolPDF 3.0.2.256 allows remote attackers to execute arbitrary code via a PDF document with a crafted stream...

CVE-2012-4914

CVE-2012-4914 affects CoolPDF Reader prior to version 3.0.2.256. The vulnerability is a stack-based buffer overflow in the image stream processing of PDFs, caused by parsing a crafted stream, which can lead to remote code execution. Public records in connected documents confirm an exploit surface...