moodle -- multiple vulnerabilities

Marina Glancy reports: MSA-15-0026: Possible phishing when redirecting to external site using referer header. CVE-2015-3272 MSA-15-0027: Capability 'mod/forum:canposttomygroups' is not respected when using 'Post a copy to all groups' in forum CVE-2015-3273 MSA-15-0028: Possible XSS through custom...

CVE-2015-2271

tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag capability before proceeding with a flaginappropriate action, which allows remote authenticated users to bypass intended access restrictions via the "Flag as...

DEBIAN-CVE-2014-7975

The doumount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAPSYSADMIN capability for doremountsb calls that change the root filesystem to read-only, which allows local users to cause a denial of service loss of writability by making certain unshare system calls...

Kernel: AACRAID Driver compat IOCTL missing capability check

The aaccompatioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAPSYSRAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call...

UBUNTU-CVE-2013-6383

The aaccompatioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAPSYSRAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call...

UBUNTU-CVE-2013-0268

The msropen function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c...

CVE-2012-5481

Summary: CVE-2012-5481 affects Moodle 2.3.x before 2.3.3. An authenticated remote user can bypass the moodle/role:manage capability on the Check Permissions page and read all capability data, causing information disclosure. Affected product/versions: Moodle 2.3.x prior to 2.3.3. Root cause (as re...

CVE-2012-2354

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL...

Design/Logic Flaw

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass question:use capability requirements and add arbitrary questions to a quiz via the questions feature...

UBUNTU-CVE-2012-2356

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...

CVE-2012-2356

Summary of CVE-2012-2356 Affected: Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3. Issue: remote authenticated users can bypass intended capability requirements in the question-bank feature and save questions via a save_question action. Root cause: not explicitly detailed in the provided docume...

CVE-2012-2354

Vulnerability summary (CVE-2012-2354): Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allow remote authenticated users to bypass the moodle/site:readallmessages capability and read arbitrary messages by tampering the URL parameter in the Recent conversations feature. The issue affects Moodle in...

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

CentOS Update for kernel CESA-2009:0001-01 centos2 i386

Check for the Version of kernel OpenVAS Vulnerability Test CentOS Update for kernel CESA-2009:0001-01 centos2 i386 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

USN-1162-1: Linux kernel vulnerabilities (Marvell Dove)

Brad Spengler discovered that the kernel did not correctly account for userspace memory allocations during exec calls. A local attacker could exploit this to consume all system memory, leading to a denial of service. CVE-2010-4243 Alexander Duyck discovered that the Intel Gigabit Ethernet driver...

PT-2013-1385 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 2.6.38 Description: The issue allows local users to bypass an intended capability requirement, enabling them to load arbitrary modules. This is achieved by leveraging the CAP NET ADMIN capability in the dev load...