Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list

35added in the last 30 days

479new WordPress flaws this week

390,525entries in the database

663 results · page 7 of 14

Jul 10, 2018A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7.CVE-2018-10889 · Other software · [UNKNOWN] · reported by Red HatMedium 4.3
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
May 25, 2018An issue was discovered in Moodle 3.x.CVE-2018-1137 · Other software · Moodle · reported by Red HatHigh 8.1
An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
May 25, 2018An issue was discovered in Moodle 3.x.CVE-2018-1136 · Other software · Moodle · reported by Red HatMedium 4.3
An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
May 25, 2018An issue was discovered in Moodle 3.x.CVE-2018-1135 · Other software · Moodle · reported by Red HatMedium 6.5
An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
May 25, 2018An issue was discovered in Moodle 3.x.CVE-2018-1134 · Other software · Moodle · reported by Red HatMedium 6.5
An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
May 25, 2018An issue was discovered in Moodle 3.x.CVE-2018-1133 · Other software · Moodle · reported by Red HatHigh 8.8
An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server, aka eval injection.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Apr 4, 2018A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4.CVE-2018-1082 · Other software · Red Hat, Inc. · reported by Red HatHigh 8.1
A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org securityfocus.com
Apr 4, 2018A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions.CVE-2018-1081 · Other software · Red Hat, Inc. · reported by Red HatMedium 5.3
A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error emails to admin after request origin was verified, otherwise admin email can be spammed.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com git.moodle.org
Jan 22, 2018In Moodle 3.x, there is XSS via a calendar event name.CVE-2018-1045 · Other software · Moodle · reported by Red HatMedium 5.4
In Moodle 3.x, there is XSS via a calendar event name.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 22, 2018In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.CVE-2018-1044 · Other software · Moodle · reported by Red HatMedium 4.3
In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 22, 2018In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.CVE-2018-1043 · Other software · Moodle · reported by Red HatMedium 6.5
In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 22, 2018Moodle 3.x has Server Side Request Forgery in the filepicker.CVE-2018-1042 · Other software · Moodle · reported by Red HatMedium 6.5
Moodle 3.x has Server Side Request Forgery in the filepicker.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com securityfocus.com
Nov 20, 2017In Moodle 3.x, students can find out email addresses of other students in the same course.CVE-2017-15110 · Other software · Moodle · reported by Red HatMedium 4.3
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Sep 18, 2017In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.CVE-2017-12157 · Other software · Moodle · reported by Red HatMedium 4.3
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Sep 18, 2017Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.CVE-2017-12156 · Other software · Moodle · reported by Red HatMedium 6.1
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jul 17, 2017In Moodle 3.x, course creators are able to change system default settings for courses.CVE-2017-7532 · Other software · Moodle · reported by MITREMedium 6.5
In Moodle 3.x, course creators are able to change system default settings for courses.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jul 17, 2017In Moodle 3.3, the course overview block reveals activities in hidden courses.CVE-2017-7531 · Other software · Moodle · reported by MITREMedium 4.3
In Moodle 3.3, the course overview block reveals activities in hidden courses.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jul 17, 2017Moodle 3.x has user fullname disclosure on the user preferences page.CVE-2017-2642 · Other software · Moodle · reported by MITREMedium 6.5
Moodle 3.x has user fullname disclosure on the user preferences page.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
May 15, 2017In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration seCVE-2017-7491 · Other software · Moodle · reported by Red HatMedium 4.3
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moodle.org moodle.org
May 15, 2017In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.CVE-2017-7490 · Other software · Moodle · reported by Red HatMedium 5.3
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moodle.org moodle.org
May 15, 2017In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.CVE-2017-7489 · Other software · Moodle · reported by Red HatMedium 6.3
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moodle.org moodle.org
Apr 20, 2017Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlCVE-2016-3734 · Other software · Moodle · reported by Red HatHigh 8.8
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for requests that marks forum posts as read.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
Apr 20, 2017The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated usCVE-2016-3733 · Other software · Moodle · reported by Red HatMedium 4.3
The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
Apr 20, 2017The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote auCVE-2016-3732 · Other software · Moodle · reported by Red HatMedium 4.3
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securitytracker.com
Apr 20, 2017Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.CVE-2016-3731 · Other software · Moodle · reported by Red HatMedium 5.3
Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securitytracker.com
Apr 20, 2017The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to eCVE-2016-3729 · Other software · Moodle · reported by Red HatMedium 6.5
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com securitytracker.com
Mar 29, 2017In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.CVE-2017-7298 · Other software · Moodle · reported by MITREMedium 5.4
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record daimacn.com daimacn.com
Mar 26, 2017In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.CVE-2017-2645 · Other software · Moodle · reported by Red HatMedium 6.1
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 26, 2017In Moodle 3.x, XSS can occur via evidence of prior learning.CVE-2017-2644 · Other software · Moodle · reported by Red HatMedium 6.1
In Moodle 3.x, XSS can occur via evidence of prior learning.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 26, 2017In Moodle 3.2.x, global search displays user names for unauthenticated users.CVE-2017-2643 · Other software · Moodle · reported by Red HatMedium 5.3
In Moodle 3.2.x, global search displays user names for unauthenticated users.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Mar 26, 2017In Moodle 2.x and 3.x, SQL injection can occur via user preferences.CVE-2017-2641 · Other software · Moodle · reported by Red HatCritical 9.8
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com securitytracker.com
Feb 10, 2017An issue was discovered in the PoodLL Filter plugin through 3.0.20 for Moodle.CVE-2017-5945 · Other software · Poodll · reported by MITREMedium 6.1
An issue was discovered in the PoodLL Filter plugin through 3.0.20 for Moodle. The vulnerability exists due to insufficient filtration of user-supplied data in the "poodll_audio_url" HTTP GET parameter passed to the "filter_poodll_moodle32_2016112802/poodll/mp3recorderskins/brazil/index.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Product
Moodle-filter Poodll
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com github.com
Jan 20, 2017In Moodle 3.x, there is XSS in the assignment submission page.CVE-2017-2578 · Other software · Moodle · reported by Red HatMedium 6.1
In Moodle 3.x, there is XSS in the assignment submission page.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.CVE-2017-2576 · Other software · Moodle · reported by Red HatMedium 5.3
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.CVE-2016-8644 · Other software · Moodle · reported by Red HatMedium 5.3
In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.CVE-2016-8643 · Other software · Moodle · reported by Red HatMedium 4.3
In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.CVE-2016-8642 · Other software · Moodle · reported by Red HatMedium 5.3
In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.CVE-2016-7038 · Other software · Moodle · reported by Red HatHigh 7.3
In Moodle 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.CVE-2016-5014 · Other software · Moodle · reported by MITREMedium 5.4
In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.CVE-2016-5013 · Other software · Moodle · reported by MITREMedium 5.4
In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Jan 20, 2017In Moodle 3.x, glossary search displays entries without checking user permissions to view them.CVE-2016-5012 · Other software · Moodle · reported by MITREMedium 5.3
In Moodle 3.x, glossary search displays entries without checking user permissions to view them.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com moodle.org
Nov 4, 2016Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtCVE-2016-9188 · Other software · Moodle · reported by MITREMedium 6.1
Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com packetstormsecurity.com
Nov 4, 2016Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrCVE-2016-9187 · Other software · Moodle · reported by MITREHigh 8.8
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com packetstormsecurity.com
Nov 4, 2016Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbiCVE-2016-9186 · Other software · Moodle · reported by MITREHigh 8.8
Unrestricted file upload vulnerability in the "legacy course files" and "file manager" modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com packetstormsecurity.com
Oct 28, 2016Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration paCVE-2016-7919 · Other software · moodle · reported by MITREHigh 7.5
Moodle 3.1.2 allows remote attackers to obtain sensitive information via unspecified vectors, related to a "SQL Injection" issue affecting the Administration panel function in the installation process component. NOTE: the vendor disputes the relevance of this report, noting that "the person who is installing Moodle must know database access credentials and they can access the database directly; there is no need for them to create a SQL injection in one of the installation dialogue fields.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com tracker.moodle.org
May 22, 2016Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remotCVE-2016-2190 · Other software · Moodle · reported by Red HatMedium 5.3
Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
May 22, 2016The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x befCVE-2016-2159 · Other software · Moodle · reported by Red HatMedium 4.3
The save_submission function in mod/assign/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote authenticated users to bypass intended due-date restrictions by leveraging the student role for a web-service request.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
May 22, 2016lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feCVE-2016-2158 · Other software · Moodle · reported by Red HatMedium 4.3
lib/ajax/getnavbranch.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3, when the forcelogin feature is enabled, allows remote attackers to obtain sensitive category-detail information from the navigation branch by leveraging the guest role for an Ajax request.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
May 22, 2016Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x bCVE-2016-2157 · Other software · Moodle · reported by Red HatHigh 8.8
Cross-site request forgery (CSRF) vulnerability in mod/assign/adminmanageplugins.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 allows remote attackers to hijack the authentication of administrators for requests that manage Assignment plugins.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com
May 22, 2016calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event CVE-2016-2156 · Other software · Moodle · reported by Red HatMedium 4.3
calendar/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 provides calendar-event data without considering whether an activity is hidden, which allows remote authenticated users to obtain sensitive information via a web-service request.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org openwall.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.