CVE-2011-4288

The CVE-2011-4288 issue affects Moodle 1.9.x up to 1.9.11 and 2.0.x up to 2.0.2, due to improper associations between teachers and groups. This allows remote authenticated users with the teacher role to read quiz reports of arbitrary students. Root cause: flawed access control for teacher-group a...

CVE-2011-4285

The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role...

CVE-2011-4288

Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role...

PT-2012-1843 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.3 Moodle versions 2.1.x through 2.1.0 Description: The issue concerns a lack of authorization check in the moodle enrol external:role assign function, allowing remote authenticated users to gain privileges by...

PT-2012-1844 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.3 Moodle versions 2.1.x through 2.1.0 Description: The issue allows remote authenticated users to modify course filters by leveraging the course-creator role, which is assigned incorrect capabilities...

CVE-2011-4309

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL...

CVE-2011-4309

Affected software: Moodle 2.0.x (before 2.0.5) and 2.1.x (before 2.1.2). Root cause: vulnerability in access restrictions allowing remote attackers to bypass restrictions and perform global searches by using the guest role and issuing a direct URL request. Impact: allows bypass of intended access...

CVE-2011-4309

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL...

PT-2012-1857 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description: The issue allows remote attackers to bypass intended access restrictions and perform global searches. This is achieved by leveraging the guest role and makin...

CVE-2012-2381

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role...

SA-CONTRIB-2012-096 - Authoring HTML - Cross Site Scripting (XSS)

This module creates an input format suitable for use within a WYSIWYG editor. It adds support for the iframe HTML tag, making it friendly with the popular iframe embeds available in popular video sites like YouTube and Vimeo. It supports the script tag too. Both tags will only be allowed if the...

May 2012 – Mythic/Kickstarter

‘Mythic: Stories of Gods and Men’ was yanked from the increasingly popular crowd-funding website, Kickstarter, earlier this year after it became apparent that the game was, in actuality, a sham. Mythic touted itself as an action/strategy based role playing game and managed to raise $4,739 from 83...

Croogo v1.3.4 CMS - Multiple Web Vulnerabilities

Document Title: =============== Croogo v1.3.4 CMS - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=533 Release Date: ============= 2012-04-28 Vulnerability Laboratory ID VL-ID: ==================================== 533 Produc...

Liferay 6.1 can be compromised in its default configuration

Liferay 6.1 can be compromised in its default configuration Description: Liferay Portal is an enterprise portal written in Java By utilizing the json webservices exposed by the platform you can register a new user with any role in the system, including the built in administrator role. The problem...

SA-CONTRIB-2012-048 - Contact Save - Cross Site Scripting

CVE: CVE-2012-2075 This module stores in the database all messages submitted through the core contact forms, and provides a way to respond to these messages through the website. The module doesn't sufficiently filter user supplied text, leading to a cross-site scripting XSS vulnerability. This...

PHP Grade Book 1.9.4 SQL Database Export

'PHP Grade Book' Unauthenticated SQL Database Export CVE-2012-1670 Mark Stanislav - [email protected] I. DESCRIPTION --------------------------------------- A vulnerability exists in admin/index.php that allows for an unauthenticated user to export the entire application database by...

SA-CONTRIB-2012-041 - Fancy Slide - Cross Site Scripting (XSS)

CVE: CVE-2012-2068 This module enables you to create slideshow blocks to embed into templates. The module doesn't sufficiently filter user supplied text. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer fancyslide". Versions affected...

CVE-2012-1497

The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role...

Directory traversal

The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role...