CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

UBUNTU-CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

CVE-2017-12157

CVE-2017-12157 affects Moodle 3.x where certain course reports allow teachers to view details about users in groups they cannot access. The issue is described in multiple advisories and CVEs linked to Moodle sensitive information disclosure. Connected sources confirm affected product is Moodle, w...

CVE-2017-12157

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access...

Automating Opera browser with Selenium WebDriver and Python

The right way to automate a web application is, certainly, to understand how this application works, by using burp see "Burp Suite Free Edition and NTLM authentication in ASP.net applications" for example, retrieve all necessary requests and learn how to use them. However, this is sometimes so...

taylorprotraining.com XSS vulnerability

Vulnerable URL: http://www.taylorprotraining.com/course-inquiry.php?id=28%22%27--!%3E%3C/Title/%3C/Style/%3C/Script/%3C/Textarea/%3C/Noscript/%3C/Pre/%3C/Xmp%3E%3CBody/OnPageShow=confirmOPENBUGBOUNTY%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 17.12.2017...

Microsoft Windows kernel Pool overflow flaws vulnerabilities bug:object is a combination of Spray vulnerability use-vulnerability warning-the black bar safety net

This article I will first briefly introduce a Foundation with the Windows kernel pool overflow exploit bugs, flaws, and how to use hybrid kernel object radiation the kernel pool, via a process shrouded TypeIndex order to achieve flaws in the application. 0x01 the first volume In the added complet...

[SECURITY] Fedora 25 Update: moodle-3.1.7-1.fc25

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

[SECURITY] Fedora 24 Update: moodle-3.1.7-1.fc24

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

[SECURITY] Fedora 26 Update: moodle-3.2.4-1.fc26

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators crea te effective online learning communities...

Information Disclosure

Moodle is vulnerable to information disclosure. The moodle/course:viewhiddencourses capability is not taken into account before listing hidden courses to authenticated users. Using this flaw, authenticated attackers can find names and summary information about courses...

Capability Bypass

Moodle is vulnerable to capability bypass. Authenticated attackers can bypass the mod/lti:view capability because it is only checked at a course level rather than the activity level...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script through the course summary field on the course request pending approval page...

Information Disclosure

Moodle is vulnerable to information disclosure. The library functions coreenrolgetcourseenrolmentmethods and enrolselfgetinstanceinfo don't check course visibility permissions, allowing a malicious user to access hidden courses...

Information Disclosure

Moodle is vulnerable to information disclosure. The library allows a guest user to enumerate through sensitive course category details even when force login is enabled...

Information Disclosure

Moodle is vulnerable to information disclosure. Authenticated attackers can use the coreenrolgetenrolledusers web service to obtain sensitive information about course-participants...

Course Name Disclosure

Moodle is vulnerable to course name disclosure. Authenticated attackers can leverage a flaw in admin/tool/monitor/lib.php to find hidden course names by subscribing to rules. These attacks are possible because moodle ignores the moodle/course:viewhiddencourses capability...

Cross-Site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. The attacks are possible because searchpagination function in course/classes/managementrenderer.php does not sanitized the search string in course management interface...

Sensitive Course Structure Information Disclosure

Moodle is vulnerable to sensitive course information disclosure. The disclosure is possible because users with suspended enrollments are not limited from viewing the course structure in the navigation tree...