CVE-2008-3326

Cross-site scripting XSS vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter blog entry title...

CVE-2008-3327

CVE-2008-3327 affects Moodle 1.6.5. When PHP display_errors is enabled, a direct request to blog/blogpage.php or course/report/stats/report.php can disclose the installation path in an error message. The connected documents confirm the affected software and the precise endpoints involved, but do ...

PR08-13: Persistent Cross-site Scripting (XSS) on Moodle via blog entry title

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-13: Persistent Cross-site Scripting XSS on Moodle via blog entry title Vulnerability found: 20/06/2008 Vendor informed: 25/06/2008 Vulnerability fixed: 16/07/2008 Advisory publicly released: 22/07/2008 Severity: High Description: By creating a ne...

Moodle etitle参数HTML注入漏洞

BUGTRAQ ID: 30348 Moodle是流行的开放源码课程管理系统。 Moodle的blog/edit.php文件中没有正确地过滤对etitle参数的输入便进行了存储，如果远程攻击者提交了创建带有恶意标题的blog项请求的话，就会在用户浏览器中注入并执行任意HTML和脚本代码。 Moodle Moodle 1.7.x Moodle Moodle 1.6.x Moodle ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://cvs.moodle.org/moodle/blog/lib.php?r1=1.38.6.3&r2=1.38.6....

PR08-16: CSRF (Cross-site Request Forgery) on Moodle edit profile page

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-16: CSRF Cross-site Request Forgery on Moodle edit profile page Vulnerability found: 25/06/2008 Vendor informed: 28/06/2008 Vulnerability fixed: 16/07/2008 Advisory publicly released: 22/07/2008 Severity: High Description: HTTP requests can be...

PR08-15: Several Webroot Disclosures on Moodle

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-15: Several Webroot Disclosures on Moodle Vulnerability found: 20/06/2008 Vendor informed: 25/06/2008 Vulnerability fixed: 16/07/2008 Advisory publicly released: 22/07/2008 Severity: Low Description: Moodle 1.6.5 is vulnerable to several webroot...

ProCheckUp Security Advisory 2008.16

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-16: CSRF Cross-site Request Forgery on Moodle edit profile page Vulnerability found: 25/06/2008 Vendor informed: 28/06/2008 Vulnerability fixed: 16/07/2008 Advisory publicly released: 22/07/2008 Severity: High Description: HTTP requests can be...

ProCheckUp Security Advisory 2008.13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 PR08-13: Persistent Cross-site Scripting XSS on Moodle via blog entry title Vulnerability found: 20/06/2008 Vendor informed: 25/06/2008 Vulnerability fixed: 16/07/2008 Advisory publicly released: 22/07/2008 Severity: High Description: By creating a ne...

openSUSE 10 Security Update : moodle (moodle-5439)

An incorrect input validation in moodle could be exploited by attackers to conduct cross site scripting attacks CVE-2008-1502. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update moodle-5439. The...

Fedora 8 : moodle-1.8.5-1.fc8 (2008-6226)

Security fixes, updated language packs. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL...

[SECURITY] Fedora 8 Update: moodle-1.8.5-1.fc8

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

Cross site scripting

The badprotocolonce function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting XSS attacks via a string containing crafted URL protocols...

CVE-2008-1502

The badprotocolonce function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting XSS attacks via a string containing crafted URL protocols...

DEBIAN-CVE-2008-1502

The badprotocolonce function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting XSS attacks via a string containing crafted URL protocols...

CVE-2008-1502

The CVE-2008-1502 issue concerns the _bad_protocol_once function in KSES (phpgwapi/inc/class.kses.inc.php). In affected products (notably Moodle < 1.8.5 and eGroupWare

CVE-2008-1502

The badprotocolonce function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting XSS attacks via a string containing crafted URL protocols...

CVE-2008-1502

The badprotocolonce function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting XSS attacks via a string containing crafted URL protocols...

openSUSE 10 Security Update : moodle (moodle-5109)

A bug in the smarty version contained in moodle could be exploited by attackers to execute arbitrary php code CVE-2008-1066. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update moodle-5109. The te...

openSUSE 10 Security Update : moodle (moodle-4964)

The install script of moodle is vulnerable to cross site scripting XSS. This flaw is only exploitable if moodle isn't fully installed yet. Therefore it's unlikely to be much of a problem in practice. To actually exploit it an attacker would have to know about a person that is just about to instal...

Debian Security Advisory DSA 1030-1 (moodle)

The remote host is missing an update to moodle announced via advisory DSA 1030-1. Several vulnerabilities have been discovered in libphp-adodb, the 'adodb' database abstraction layer for PHP, which is embedded in moodle, a course management system for online learning. The Common Vulnerabilities a...