Moodle — система управления образовательными электронными курсами
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 764
GHSA-vg4g-6rhx-p7rr
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
GHSA-xf6r-r485-49mr
Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf.
GHSA-332g-xh34-5c96
Moodle Privilege escalation in quiz web services
GHSA-4m6v-x9fj-847j
Moodle Cross-site Scripting in the Course summary filter of the Add a new course
GHSA-595j-wpfg-23w4
Moodle XSS Vulnerability
GHSA-vxmv-74rf-vqgp
Moodle Portfolio forum caller class allows a user to download any file
GHSA-vxqh-mx28-7ghw
Moodle Portfolio script allows instantiation of class chosen by user
GHSA-qqjv-mc2v-p7mc
Moodle SSRF Vulnerability
GHSA-vjxx-54vw-q59f
Moodle SSRF Vulnerability
GHSA-m38p-4c43-vjrc
SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| GHSA-vg4g-6rhx-p7rr Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors. | CVSS3: 8.8 | 4% Низкий | больше 4 лет назад |
| GHSA-xf6r-r485-49mr Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.4.0 through 2.8.1, as used in Bugzilla, Moodle, and other products, allows remote attackers to inject arbitrary web script or HTML via vectors related to charts/assets/charts.swf. | 5% Низкий | больше 4 лет назад | |
| GHSA-332g-xh34-5c96 Moodle Privilege escalation in quiz web services | CVSS3: 4.3 | 1% Низкий | больше 4 лет назад |
| GHSA-4m6v-x9fj-847j Moodle Cross-site Scripting in the Course summary filter of the Add a new course | CVSS3: 5.4 | 1% Низкий | больше 4 лет назад |
| GHSA-595j-wpfg-23w4 Moodle XSS Vulnerability | CVSS3: 5.4 | 1% Низкий | больше 4 лет назад |
| GHSA-vxmv-74rf-vqgp Moodle Portfolio forum caller class allows a user to download any file | CVSS3: 6.5 | 1% Низкий | больше 4 лет назад |
| GHSA-vxqh-mx28-7ghw Moodle Portfolio script allows instantiation of class chosen by user | CVSS3: 8.1 | 2% Низкий | больше 4 лет назад |
| GHSA-qqjv-mc2v-p7mc Moodle SSRF Vulnerability | CVSS3: 6.5 | 16% Средний | больше 4 лет назад |
| GHSA-vjxx-54vw-q59f Moodle SSRF Vulnerability | CVSS3: 7.5 | 1% Низкий | больше 4 лет назад |
| GHSA-m38p-4c43-vjrc SQL injection vulnerability in the hotpot_delete_selected_attempts function in report.php in the HotPot module in Moodle 1.6 before 1.6.7, 1.7 before 1.7.5, 1.8 before 1.8.6, and 1.9 before 1.9.2 allows remote attackers to execute arbitrary SQL commands via a crafted selected attempt. | 1% Низкий | больше 4 лет назад |
Уязвимостей на страницу