GHSA-5659-G9P4-354F Moodle allows attackers to bypass a forced-password-change requirement

login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token...

CVE-2019-19998

Xiuno BBS 4.0 allows XXE via plugin/xnwechatpublic/route/token.php...

CVE-2019-19998: Improper Restriction of XML External Entity Reference

Xiuno BBS 4.0 allows XXE via plugin/xnwechatpublic/route/token.php...

PT-2019-16038

Name of the Vulnerable Software and Affected Versions Xiuno BBS version 4.0 Description The issue allows for XXE XML External Entity attacks. This is due to a vulnerability in the plugin/xn wechat public/route/token.php file. Recommendations For Xiuno BBS version 4.0, consider disabling the...

CVE-2015-2272

login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token...

CVE-2015-2272

Impact: Moodle

CVE-2015-2272: Undefined Security Weakness

login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to bypass a forced-password-change requirement by creating a web-services token...

PT-2015-1593

Name of the Vulnerable Software and Affected Versions Moodle versions 2.5.9 and earlier, 2.6.x before 2.6.9, 2.7.x before 2.7.6, 2.8.x before 2.8.4 Description The issue is related to insufficient access control in the login/token.php component of the Moodle learning management system. This allow...

CVE-2014-0214: Improper Authentication

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

CVE-2014-0214

CVE-2014-0214 affects Moodle versions up to 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3. The vulnerability arises in login/token.php, which creates a MoodleMobile web-service token with an infinite lifetime. This allows remote attackers to hijack sessions more easily v...

CVE-2014-0214

login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which makes it easier for remote attackers to hijack sessions via a brute-force attack...

PT-2014-3538

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.10, 2.5.x before 2.5.6, 2.6.x before 2.6.3 Description The issue allows remote attackers to hijack sessions via a brute-force attack because login/token.php creates a MoodleMobile web-servic...

PT-2012-3666

Name of the Vulnerable Software and Affected Versions Newscoop versions 3.5.x through 3.5.4 Newscoop versions 4.x through 4 RC3 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the "Back" parameter to "admin/ad.php", or the token or f...