CVE-2010-4536

Multiple cross-site scripting XSS vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 the & ampersand character, 2 the case of an attribute name, 3 a padded entity, and 4 an entity that is not in...

CVE-2010-4536

CVE-2010-4536 describes multiple XSS vulnerabilities in WordPress’s KSES filter, exploitable in WordPress versions prior to 3.0.4. The issue allows an unauthenticated, remote attacker to inject arbitrary script/HTML via several vectors related to (1) ampersand handling, (2) attribute-name case, (...

Moodle XSS and CSRF Vulnerabilities

Moodle is prone to cross-site ccripting XSS and cross-site request forgery CSRF vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

Fedora 13 : moodle-1.9.9-1.fc13 (2010-10291)

Moodle upstream has released v1.9.9 and v1.8.13: http://docs.moodle.org/en/Moodle1.9.9releasenotes http://docs.moodle.org/en/Moodle1.8.13releasenotes Which address the following issues: MSA-10-0010 Persistent Cross Site Scripting vulnerability in the MNET access control interface MSA-10-0011 Cros...

CVE-2010-2230

The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting XSS attacks via HTML input...

CVE-2010-2230

The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting XSS attacks via HTML input...

Cross site scripting

The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting XSS attacks via HTML input...

CVE-2010-2230

The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting XSS attacks via HTML input...

CVE-2010-2230

CVE-2010-2230 (Moodle) affects the Moodle web app’s KSES HTML text cleaning library (lib/weblib.php). The root cause is the KSES filter failing to properly handle vbscript URIs, allowing remote authenticated users to inject arbitrary HTML/script via HTML input (XSS). Affected are Moodle 1.8.13- a...

CVE-2010-2230

The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting XSS attacks via HTML input...

Moodle < 1.8.13 / 1.9.x < 1.9.9 Multiple Vulnerabilities

Binary data 5575.prm...

CVE-2010-1619

Cross-site scripting XSS vulnerability in the fixnonstandardentities function in the KSES HTML text cleaning library weblib.php, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities...

Cross site scripting

Cross-site scripting XSS vulnerability in the fixnonstandardentities function in the KSES HTML text cleaning library weblib.php, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities...

CVE-2010-1619

Cross-site scripting XSS vulnerability in the fixnonstandardentities function in the KSES HTML text cleaning library weblib.php, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities...

CVE-2010-1619

CVE-2010-1619 affects Moodle’s KSES HTML text cleaning library (weblib.php) via the fix_non_standard_entities function. The vulnerability allows remote XSS by crafting HTML entities and is reported in Moodle 1.8.x prior to 1.8.12 and 1.9.x prior to 1.9.8. Related advisories describe multiple link...

DSA-1691-1 moodle - several vulnerabilities

Bulletin has no description...

Debian DSA-1691-1 : moodle - several vulnerabilities

Several remote vulnerabilities have been discovered in Moodle, an online course management system. The following issues are addressed in this update, ranging from cross site scripting to remote code execution. Various cross site scripting issues in the Moodle codebase CVE-2008-3326, CVE-2008-3325...

Moodle 'lib/kses.php' 'kses_bad_protocol_once' Function Arbitrary PHP Code Execution

The version of Moodle on the remote host includes a version of the KSES HTML filtering library that does not safely call 'pregreplace' in the function 'ksesbadprotocolonce' in 'lib/kses.php'. An unauthenticated, remote attacker can leverage this issue to inject arbitrary PHP code that will be...

Vulnerabilities in kses-based HTML filters

Vulnerabilities in kses-based HTML filters ========================================== During internal code review performed by Allegro.pl, some weaknesses were discovered in kses - PHP HTML/XHTML filter. HTML filters using or based on kses are part of many popular projects, including WordPress,...

CVE-2008-1502

The badprotocolonce function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting XSS attacks via a string containing crafted URL protocols...