CVE-2017-16226

The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution...

CVE-2017-16226

The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution...

CVE-2017-16088

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox...

PT-2018-6116

Name of the Vulnerable Software and Affected Versions: safe-eval versions prior to 0.4.0 Description: The issue allows un-sanitized user input to access the entire standard library by accessing object constructors, effectively breaking out of the sandbox. This can be achieved by exploiting the...

CVE-2017-16088: Externally Controlled Reference to a Resource in Another Sphere

The safe-eval module describes itself as a safer version of eval. By accessing the object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox...

static-eval Arbitrary Code Execution Vulnerability

static-eval is a module for evaluating statically analyzable expressions. A security vulnerability exists in static-eval. An attacker can exploit this vulnerability to execute arbitrary code by accessing the constructor of the global function...

CVE-2017-16226: Improper Input Validation

The static-eval module is intended to evaluate statically-analyzable expressions. In affected versions, untrusted user input is able to access the global function constructor, effectively allowing arbitrary code execution...

PT-2018-6255

Name of the Vulnerable Software and Affected Versions: static-eval versions prior to 2.0.0 Description: The issue allows untrusted user input to access the global function constructor, effectively enabling arbitrary code execution. This occurs because affected versions of the static-eval module...

PT-2018-4726

Name of the Vulnerable Software and Affected Versions reduce-css-calc versions =1.2.4 Description Arbitrary code execution is possible through crafted CSS, making cross-site scripting XSS possible on the client and arbitrary code injection possible on the server. This occurs because user input is...

Moodle 3.x Multiple Vulnerabilities (May 2018) - Linux

Moodle CMS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

Design/Logic Flaw

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

CVE-2018-1133

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

CVE-2018-1133

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

CVE-2018-1133

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

UBUNTU-CVE-2018-1133

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

CVE-2018-1133

Moodle 3.x is affected by CVE-2018-1133 via the Calculated question type. A teacher can cause remote code execution on the server through eval injection. Root cause is input evaluated by the server (eval) when creating Calculated questions. Impact is remote code execution with high severity (CVE-...

CVE-2018-1133

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

CVE-2018-1133

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...

PT-2018-10489

Name of the Vulnerable Software and Affected Versions Moodle versions 3.x Description An issue was discovered that allows a Teacher creating a Calculated question to intentionally cause remote code execution on the server through eval injection. Recommendations For Moodle versions 3.x, update to ...

CVE-2018-1133: Improper Control of Generation of Code

An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection...