174 matches found
Mageia: Security Advisory (MGASA-2014-0308)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ROS-2-845
2.845 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...
ROS-2-2197
2.2197 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...
ROS-2-1246
2.1246 Multiple vulnerabilities in Moodle CVE-2021-32472 - CVE-2021-32478 1. Vulnerability Description: CVE-2021-32478 A vulnerability exists due to insufficient cleansing of user-provided data at the LTI authorization endpoint. A remote attacker could trick a victim into clicking a specially...
Moodle < 3.8.9, 3.9.x < 3.9.7, 3.10.x < 3.10.4 XSS Vulnerability
Moodle is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...
PT-2021-3111
Name of the Vulnerable Software and Affected Versions Moodle versions 3.10 to 3.10.3 Moodle versions 3.9 to 3.9.6 Moodle versions 3.8 to 3.8.8 Moodle versions prior to 3.8 Description The issue arises from insufficient sanitizing of user-provided data in the LTI authorization endpoint, leading to...
TAO Open Source Assessment Platform 3.3.0 RC2 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications ======================================================================= title: Multiple XSS vulnerabilities product: TAO Open Source Assessment Platform vulnerable version: 3.3.0 RC2 fixed version: - CVE number: - impact: medium homepage:...
lti-af.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-984545 Security Researcher devl00p Helped patch 3000 vulnerabilities Received 10 Coordinated Disclosure badges Received 15 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting lti-af.com website and it...
Moodle CMS 3.4.x <= 3.4.7, 3.5.x <= 3.5.4 and 3.6.x <= 3.6.2 Multiple Vulnerabilities
Moodle CMS is prone to multiple vulnerabilities. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundatio...
Privilege Escalation
Moodle is vulnerable to privilege escalation. The vulnerability exists because it does not prevent modification of the request to the LTI publisher site, allowing a user to assign an escalated role without authorization...
CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...
CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...
CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...
Design/Logic Flaw
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...
CVE-2019-3849
CVE-2019-3849 affects Moodle prior to 3.6.3, 3.5.5 and 3.4.8. The issue allows users to escalate their role within courses or content accessed via LTI by tampering requests to the LTI publisher site. Impact described as privilege escalation (high/partial in some metrics depending on vector); expl...
CVE-2019-3849
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site...
Cross-site Request Forgery (CSRF)
Moodle is vulnerable to cross-site request forgery CSRF attacks. The application does not check the session key in mod/lti/requesttool.php and mod/lti/instructoredittooltype.php, allowing a malicious user to hijack authentication of an arbitrary user...
Information Disclosure
Moodle is vulnerable to information disclosure. Authenticated attackers can get sensitive information from LTI Ajax requests because the moodle/course:manageactivities and the mod/lti:addinstance capabilities are not considered before registered-tool lists are searched...
XML External Entity (XXE)
Moodle is vulnerable to XML external entity XXE attacks. A malicious user can pass an XML file to the application through a LTI server to cause an XXE attack, allowing the user to read arbitrary files...
