Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-3244 State: PUBLISHED Published: 2015-07-16T10:00:00 Last Updated: 2024-08-06T05:39:32.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict access to restricted resources, which allows remote attackers to obtain sensitive information via a URL with a modified resource ID. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html - http://www.securityfocus.com/bid/75941 - http://rhn.redhat.com/errata/RHSA-2015-1226
/security/cpujul2015-2367936.html - http://www.securityfocus.com/bid/75941 - http://rhn.redhat.com/errata/RHSA-2015-1226.html - https://bugzilla.redhat.com/show_bug.cgi?id=1232908
CVE ID: CVE-2015-3245 State: PUBLISHED Published: 2015-08-11T14:00:00 Last Updated: 2024-08-06T05:39:32.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incomplete blacklist vulnerability in the chfn function in libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, allows local users to cause a denial of service (/etc/passwd corruption) via a newline character in the GECOS field. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html - https://www.exploit-db.com/exploits/44633/ - https://access.redhat.com/articles/1537873 - http://rhn.
July/162947.html - https://www.exploit-db.com/exploits/44633/ - https://access.redhat.com/articles/1537873 - http://rhn.redhat.com/errata/RHSA-2015-1482.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html - https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt - http://www.securitytracker.com/id/1033040 - http://www.securityfocus.com/bid/76021 - http://rhn.redhat.com/errata/RHSA-2015-1483.html
CVE ID: CVE-2015-3246 State: PUBLISHED Published: 2015-08-11T14:00:00 Last Updated: 2024-08-06T05:39:32.107Z Vendors: n/a Products: n/a Problem Types: n/a Description: libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/76022 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html - https://
securityfocus.com/bid/76022 - http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162947.html - https://www.exploit-db.com/exploits/44633/ - https://access.redhat.com/articles/1537873 - http://rhn.redhat.com/errata/RHSA-2015-1482.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163044.html - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00000.html - https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt - http://www.securitytracker.com/id/1033040 - http://rhn.redhat.com/errata/RHSA-2015-1483.html
CVE ID: CVE-2015-3247 State: PUBLISHED Published: 2015-09-08T15:00:00 Last Updated: 2024-08-06T05:39:32.149Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the worker_update_monitors_config function in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute arbitrary code on the host via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2736-1 - http://www.debian.org/security/2015/dsa-3354 - http://rhn.redhat.com/errata/RHSA-2015-1715.html - http://lists.freedesktop.org/archives/spice-devel/2015-Octobe
-3354 - http://rhn.redhat.com/errata/RHSA-2015-1715.html - http://lists.freedesktop.org/archives/spice-devel/2015-October/022191.html - http://lists.opensuse.org/opensuse-updates/2015-09/msg00018.html - http://www.securitytracker.com/id/1033460 - http://www.securitytracker.com/id/1033459 - http://www.securitytracker.com/id/1033753 - http://rhn.redhat.com/errata/RHSA-2015-1714.html - http://rhn.redhat.com/errata/RHSA-2015-1713.html
CVE ID: CVE-2015-3248 State: PUBLISHED Published: 2017-09-26T15:00:00 Last Updated: 2024-08-06T05:39:32.150Z Vendors: n/a Products: n/a Problem Types: n/a Description: openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service (disk consumption). Additional Analyst Notes: - CVE Program Container: References: - http://openhpi.org/Changelogs/3.6.0 - http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168841.html - https://bugzilla.redhat.com/show_bug.cgi?id=1233521
CVE ID: CVE-2015-3249 State: PUBLISHED Published: 2017-10-30T14:00:00 Last Updated: 2024-08-06T05:39:32.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.1 allows remote attackers to cause a denial of service (out-of-bounds access and daemon crash) or possibly execute arbitrary code via vectors related to the (1) frame_handlers array or (2) set_dynamic_table_size function. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/101631 - https://yahoo-security.tumblr.com/post/122883273670/apache-traffic-server-http2-fuzzing - http://mail-archives.us.apache.org/mod_
ahoo-security.tumblr.com/post/122883273670/apache-traffic-server-http2-fuzzing - http://mail-archives.us.apache.org/mod_mbox/www-announce/201507.mbox/%3CCABF6JR37mWzDmXDqRQwRUXiojBZrhidndnsY1ZgmcZv-o7-a+g%40mail.gmail.com%3E
CVE ID: CVE-2015-3250 State: PUBLISHED Published: 2017-09-07T13:00:00 Last Updated: 2024-08-06T05:39:32.148Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/07/07/11 - https://bugzilla.redhat.com/show_bug.cgi?id=1241163 - http://www.openwall.com/lists/oss-security/2015/07/07/5 - http://directory.apache.org/api/#news_1
CVE ID: CVE-2015-3251 State: PUBLISHED Published: 2016-02-08T19:00:00 Last Updated: 2024-08-06T05:39:32.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache CloudStack before 4.5.2 might allow remote authenticated administrators to obtain sensitive password information for root accounts of virtual machines via unspecified vectors related to API calls. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories - http://www.securityfocus.com/archive/1/537458/100/0/threaded - http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C94DD4CB4-F718-4F79-A934-3D677E497114%40gmail
- http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C94DD4CB4-F718-4F79-A934-3D677E497114%40gmail.com%3E
CVE ID: CVE-2015-3252 State: PUBLISHED Published: 2016-02-08T19:00:00 Last Updated: 2024-08-06T05:39:32.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache CloudStack before 4.5.2 does not properly preserve VNC passwords when migrating KVM virtual machines, which allows remote attackers to gain access by connecting to the VNC server. Additional Analyst Notes: - CVE Program Container: References: - https://blogs.apache.org/cloudstack/entry/two_late_announced_security_advisories - http://www.securityfocus.com/archive/1/537459/100/0/threaded - http://mail-archives.apache.org/mod_mbox/cloudstack-users/201602.mbox/%3C7508580E-3D83-49FD-BE6E-B329B0503130%40gmail.com%3E
CVE ID: CVE-2015-3253 State: PUBLISHED Published: 2015-08-13T14:00:00 Last Updated: 2024-08-06T05:39:32.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html - https://access.redhat.com/errata/RHSA-2017:2596 - http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html - https://access.redhat.com/errata/RHSA-2016:1376 - https://
e.com/technetwork/security-advisory/cpujul2016-2881720.html - https://access.redhat.com/errata/RHSA-2016:1376 - https://security.gentoo.org/glsa/201610-01 - http://groovy-lang.org/security.html - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05324755 - http://packetstormsecurity.com/files/132714/Apache-Groovy-2.4.3-Code-Execution.html - https://security.netapp.com/advisory/ntap-20160623-0001/ - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html - http://rhn.redhat.com/errata/RHSA-2016-0066.html - http://www.oracle.com/technetwork/security-advisory/cpuapr201
.html - http://rhn.redhat.com/errata/RHSA-2016-0066.html - http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html - http://www.securityfocus.com/bid/91787 - http://www.zerodayinitiative.com/advisories/ZDI-15-365/ - https://access.redhat.com/errata/RHSA-2017:2486 - http://www.securitytracker.com/id/1034815 - http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html - http://www.securityfocus.com/bid/75919 - http://www.securityfocus.com/archive/1/536012/100/0/threaded - https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/rbb8e16cc5aca
72813.html - https://www.oracle.com/security-alerts/cpuapr2020.html - https://lists.apache.org/thread.html/rbb8e16cc5acab183124572b655bdf5fe1d5b5f477dc267352426c7ed%40%3Cnotifications.shardingsphere.apache.org%3E
CVE ID: CVE-2015-3254 State: PUBLISHED Published: 2017-06-16T22:00:00 Last Updated: 2024-08-06T05:39:32.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function. Additional Analyst Notes: - CVE Program Container: References: - http://grokbase.com/t/thrift/user/15c2tss3td/notice-apache-thrift-security-vulnerability-cve-2015-1774 - https://issues.apache.org/jira/browse/THRIFT-3231 - http://www.securityfocus.com/bid/99112 - https://mail-archives.apache.org/mod_mbox/thrift-user/201512.mbox/%3CCANyrgvcjvEcjTVmaL+
w.securityfocus.com/bid/99112 - https://mail-archives.apache.org/mod_mbox/thrift-user/201512.mbox/%3CCANyrgvcjvEcjTVmaL+tVXCBm4o5G+1neu=MUubD9GbU85bO_Ew%40mail.gmail.com%3E - https://access.redhat.com/errata/RHSA-2017:2477 - https://access.redhat.com/errata/RHSA-2017:3115
CVE ID: CVE-2015-3255 State: PUBLISHED Published: 2015-10-26T19:00:00 Last Updated: 2024-08-06T05:39:32.026Z Vendors: n/a Products: n/a Problem Types: n/a Description: The polkit_backend_action_pool_init function in polkitbackend/polkitbackendactionpool.c in PolicyKit (aka polkit) before 0.113 might allow local users to gain privileges via duplicate action IDs in action descriptions. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201611-07 - https://usn.ubuntu.com/3717-2/ - https://bugzilla.redhat.com/show_bug.cgi?id=1245673 - http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html - http://lists.freedesktop.org/archives/polkit-deve
3 - http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html - http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html - http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html - http://www.securitytracker.com/id/1035023 - https://bugs.freedesktop.org/show_bug.cgi?id=83590
CVE ID: CVE-2015-3256 State: PUBLISHED Published: 2015-10-26T19:00:00 Last Updated: 2024-08-06T05:39:32.094Z Vendors: n/a Products: n/a Problem Types: n/a Description: PolicyKit (aka polkit) before 0.113 allows local users to cause a denial of service (memory corruption and polkitd daemon crash) and possibly gain privileges via unspecified vectors, related to "javascript rule evaluation." Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1245684 - http://rhn.redhat.com/errata/RHSA-2016-0189.html - http://www.securityfocus.com/bid/77356 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://list
yfocus.com/bid/77356 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://lists.opensuse.org/opensuse-updates/2015-11/msg00042.html - http://lists.freedesktop.org/archives/polkit-devel/2015-July/000432.html - http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00010.html - http://www.securitytracker.com/id/1035023
CVE ID: CVE-2015-3257 State: PUBLISHED Published: 2017-08-25T18:00:00 Last Updated: 2024-08-06T05:39:32.153Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zend/Diactoros/Uri::filterPath in zend-diactoros before 1.0.4 does not properly sanitize path input, which allows remote attackers to perform cross-site scripting (XSS) or open redirect attacks. Additional Analyst Notes: - CVE Program Container: References: - https://framework.zend.com/security/advisory/ZF2015-05 - http://www.securityfocus.com/bid/75466
CVE ID: CVE-2015-3258 State: PUBLISHED Published: 2015-07-14T16:00:00 Last Updated: 2024-08-06T05:39:32.039Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the WriteProlog function in filter/texttopdf.c in texttopdf in cups-filters before 1.0.70 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a small line size in a print job. Additional Analyst Notes: - CVE Program Container: References: - http://ubuntu.com/usn/usn-2659-1 - https://security.gentoo.org/glsa/201510-08 - http://www.securityfocus.com/bid/75436 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http:/
curityfocus.com/bid/75436 - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://www.openwall.com/lists/oss-security/2015/06/26/4 - http://lists.opensuse.org/opensuse-updates/2015-07/msg00033.html - http://bzr.linuxfoundation.org/loggerhead/openprinting/cups-filters/revision/7363 - https://bugzilla.redhat.com/show_bug.cgi?id=1235385 - http://www.debian.org/security/2015/dsa-3303 - http://rhn.redhat.com/errata/RHSA-2015-2360.html
CVE ID: CVE-2015-3259 State: PUBLISHED Published: 2015-07-16T14:00:00 Last Updated: 2024-08-06T05:39:32.117Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the xl command line utility in Xen 4.1.x through 4.5.x allows local guest administrators to gain privileges via a long configuration argument. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-137.html - http://www.debian.org/security/2015/dsa-3414 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00041.html - https://security.gentoo.org/glsa/201604-03 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00042.html -
tps://security.gentoo.org/glsa/201604-03 - http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00042.html - http://www.securityfocus.com/bid/75573 - http://www.securitytracker.com/id/1032973
CVE ID: CVE-2015-3260 State: REJECTED Published: 2022-07-08T17:36:27 Last Updated: 2022-07-08T17:36:27 Description: No description available.
CVE ID: CVE-2015-3261 State: REJECTED Published: 2022-07-08T17:36:31 Last Updated: 2022-07-08T17:36:31 Description: No description available.
CVE ID: CVE-2015-3262 State: REJECTED Published: 2022-07-08T17:36:35 Last Updated: 2022-07-08T17:36:35 Description: No description available.
CVE ID: CVE-2015-3263 State: REJECTED Published: 2022-07-08T17:36:40 Last Updated: 2022-07-08T17:36:40 Description: No description available.
CVE ID: CVE-2015-3264 State: REJECTED Published: 2022-07-08T17:36:44 Last Updated: 2022-07-08T17:36:44 Description: No description available.
CVE ID: CVE-2015-3265 State: REJECTED Published: 2022-07-08T17:36:48 Last Updated: 2022-07-08T17:36:48 Description: No description available.
CVE ID: CVE-2015-3266 State: REJECTED Published: 2022-07-08T17:36:52 Last Updated: 2022-07-08T17:36:52 Description: No description available.
CVE ID: CVE-2015-3267 State: PUBLISHED Published: 2015-08-11T14:00:00 Last Updated: 2024-08-06T05:39:32.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1033136 - http://rhn.redhat.com/errata/RHSA-2015-1525.html - http://www.securityfocus.com/bid/76335
CVE ID: CVE-2015-3268 State: PUBLISHED Published: 2016-04-12T14:00:00 Last Updated: 2024-08-06T05:39:32.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the DisplayEntityField.getDescription method in ModelFormField.java in Apache OFBiz before 12.04.06 and 13.07.x before 13.07.03 allows remote attackers to inject arbitrary web script or HTML via the description attribute of a display-entity element. Additional Analyst Notes: - CVE Program Container: References: - http://ofbiz.apache.org/download.html#vulnerabilities - https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04 - https://issues.apache.org/jira/browse/OFBIZ-6506 -
- https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_12_04 - https://issues.apache.org/jira/browse/OFBIZ-6506 - http://www.securitytracker.com/id/1035514 - https://blogs.apache.org/ofbiz/entry/announce_apache_ofbiz_13_07 - http://packetstormsecurity.com/files/136638/Apache-OFBiz-13.07.02-13.07.01-Information-Disclosure.html - http://www.securityfocus.com/archive/1/538033/100/0/threaded
CVE ID: CVE-2015-3269 State: PUBLISHED Published: 2015-08-25T01:00:00 Last Updated: 2024-08-06T05:39:32.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Flex BlazeDS, as used in flex-messaging-core.jar in Adobe LiveCycle Data Services (LCDS) 3.0.x before 3.0.0.354170, 4.5 before 4.5.1.354169, 4.6.2 before 4.6.2.354169, and 4.7 before 4.7.0.354169 and other products, allows remote attackers to read arbitrary files via an AMF message containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - https://h20566.www2.hpe.com/portal/site/hps
XXE) issue. Additional Analyst Notes: - CVE Program Container: References: - https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05026202 - http://marc.info/?l=bugtraq&m=145706712500978&w=2 - http://www.securityfocus.com/bid/76394 - http://www.vmware.com/security/advisories/VMSA-2015-0008.html - https://helpx.adobe.com/security/products/livecycleds/apsb15-20.html - http://www.securityfocus.com/archive/1/536266/100/0/threaded - https://helpx.adobe.com/content/help/en/security/products/coldfusion/apsb15-21.html - http://www.securitytracker.com/id/1033337 - https://www.zerodayinitiative.com/advisories/ZDI-22-508/
CVE ID: CVE-2015-3270 State: PUBLISHED Published: 2015-11-02T19:00:00 Last Updated: 2024-08-06T05:39:32.138Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Ambari before 2.0.2 or 2.1.x before 2.1.1 allows remote authenticated users to gain administrative privileges via unspecified vectors, possibly related to changing passwords. Additional Analyst Notes: - CVE Program Container: References: - https://cwiki.apache.org/confluence/display/AMBARI/Ambari+Vulnerabilities - http://www.openwall.com/lists/oss-security/2015/10/13/3
CVE ID: CVE-2015-3271 State: PUBLISHED Published: 2016-12-15T22:00:00 Last Updated: 2024-08-06T05:39:32.100Z Vendors: n/a Products: n/a Problem Types: n/a Description: Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2015/08/13/5 - https://lists.apache.org/thread.html/d2b3e7afb0251fac95fdee9817423cbc91e3d99a848c25a51d91c1e8%401439485507%40%3Cdev.tika.apache.org%3E - http://www.securityfocus.com/bid/95020
CVE ID: CVE-2015-3272 State: PUBLISHED Published: 2016-02-22T02:00:00 Last Updated: 2024-08-06T05:39:32.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL. Additional Analyst Notes: - CVE Program Container: References: - https://moodle.org/mod/forum/discuss.php?d=316662 - http://openwall.com/lists/oss-security/2015/07/13/2 - http://git.
- https://moodle.org/mod/forum/discuss.php?d=316662 - http://openwall.com/lists/oss-security/2015/07/13/2 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50688 - http://www.securitytracker.com/id/1032877
CVE ID: CVE-2015-3273 State: PUBLISHED Published: 2016-02-22T02:00:00 Last Updated: 2024-08-06T05:39:32.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization. Additional Analyst Notes: - CVE Program Container: References: - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50220 - http://openwall.com/lists/oss-security/2015/07/13/2 - http://www.securitytracker.com/id/1032877 - https://
s=MDL-50220 - http://openwall.com/lists/oss-security/2015/07/13/2 - http://www.securitytracker.com/id/1032877 - https://moodle.org/mod/forum/discuss.php?d=316663
CVE ID: CVE-2015-3274 State: PUBLISHED Published: 2016-02-22T02:00:00 Last Updated: 2024-08-06T05:39:32.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2015/07/13/2 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130 - http://www.secur
s-security/2015/07/13/2 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130 - http://www.securitytracker.com/id/1032877 - https://moodle.org/mod/forum/discuss.php?d=316664