deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1154
Published: 2016-02-19
Description: SQL injection vulnerability in the Help plug-in 1.3.5 and earlier in Cuore EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89
References: http://jvn.jp/en/jp/JVN31524757/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000027; http://www.ec-cube.net/products/detail.php?product_id=279
CVE: CVE-2016-1156
Published: 2016-02-19
Description: LINE 4.3.0.724 and earlier on Windows and 4.3.1 and earlier on OS X allows remote authenticated users to cause a denial of service (application crash) via a crafted post that is mishandled when displaying a Timeline.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN46044093/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2016-000029; http://linecorp.com/ja/security/article/53
CVE: CVE-2016-1335
Published: 2016-02-19
Description: The SSH implementation in Cisco StarOS before 19.3.M0.62771 and 20.x before 20.0.M0.62768 on ASR 5000 devices mishandles a multi-user public-key authentication configuration, which allows remote authenticated users to gain privileges by establishing a connection from an endpoint that was previously used for an administrator's connection, aka Bug ID CSCux22492.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-asr; http://www.securitytracker.com/id/1035062; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160218-asr
CVE: CVE-2016-1927
Published: 2016-02-20
Description: The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254, CWE-255
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
CVE: CVE-2016-2038
Published: 2016-02-20
Description: phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
CVE: CVE-2016-2039
Published: 2016-02-20
Description: libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, which allows remote attackers to bypass intended access restrictions by predicting a value.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
CVE: CVE-2016-2040
Published: 2016-02-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
CVE: CVE-2016-2041
Published: 2016-02-20
Description: libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for comparing CSRF tokens, which makes it easier for remote attackers to bypass intended access restrictions by measuring time differences.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
CVE: CVE-2016-2042
Published: 2016-02-20
Description: phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request to (1) libraries/phpseclib/Crypt/AES.php or (2) libraries/phpseclib/Crypt/Rijndael.php, which reveals the full path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
CVE: CVE-2016-2043
Published: 2016-02-20
Description: Cross-site scripting (XSS) vulnerability in the goToFinish1NF function in js/normalization.js in phpMyAdmin 4.4.x before 4.4.15.3 and 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a table name to the normalization page.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://lists.opensuse.org/opensuse-updates/2016-02/msg00028.html
CVE: CVE-2016-2044
Published: 2016-02-20
Description: libraries/sql-parser/autoload.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.4 allows remote attackers to obtain sensitive information via a crafted request, which reveals the full path in an error message.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://www.phpmyadmin.net/home_page/security/PMASA-2016-8.php
CVE: CVE-2016-2045
Published: 2016-02-20
Description: Cross-site scripting (XSS) vulnerability in the SQL editor in phpMyAdmin 4.5.x before 4.5.4 allows remote authenticated users to inject arbitrary web script or HTML via a SQL query that triggers JSON data in a response.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176483.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176739.html; http://www.phpmyadmin.net/home_page/security/PMASA-2016-9.php
CVE: CVE-2016-1628
Published: 2016-02-21
Description: pi.c in OpenJPEG, as used in PDFium in Google Chrome before 48.0.2564.109, does not validate a certain precision value, which allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted JPEG 2000 image in a PDF document, related to the opj_pi_next_rpcl, opj_pi_next_pcrl, and opj_pi_next_cprl functions.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_9.html; http://rhn.redhat.com/errata/RHSA-2016-0241.html; http://www.debian.org/security/2016/dsa-3486
CVE: CVE-2016-2275
Published: 2016-02-21
Description: The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-049-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-049-01
CVE: CVE-2015-7425
Published: 2016-02-21
Description: The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.4 allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21973086; http://www.securityfocus.com/bid/79545; http://www-01.ibm.com/support/docview.wss?uid=swg21973086
CVE: CVE-2016-1629
Published: 2016-02-21
Description: Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://googlechromereleases.blogspot.com/2016/02/stable-channel-update_18.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00045.html; http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00047.html
CVE: CVE-2015-3272
Published: 2016-02-22
Description: Open redirect vulnerability in the clean_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an HTTP Referer header that has a substring match with a local URL.
CVSS Score: 7.4 (HIGH)
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50688; http://openwall.com/lists/oss-security/2015/07/13/2; http://www.securitytracker.com/id/1032877
CVE: CVE-2015-3273
Published: 2016-02-22
Description: mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50220; http://openwall.com/lists/oss-security/2015/07/13/2; http://www.securitytracker.com/id/1032877
CVE: CVE-2015-3274
Published: 2016-02-22
Description: Cross-site scripting (XSS) vulnerability in the user_get_user_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allows remote attackers to inject arbitrary web script or HTML by leveraging absence of an external_format_text call in a web service.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50130; http://openwall.com/lists/oss-security/2015/07/13/2; http://www.securitytracker.com/id/1032877
CVE: CVE-2015-3275
Published: 2016-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, and 2.9.x before 2.9.1 allow remote attackers to inject arbitrary web script or HTML via a crafted organization name to (1) mod/scorm/player.php or (2) mod/scorm/prereqs.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50614; http://openwall.com/lists/oss-security/2015/07/13/2; http://www.securitytracker.com/id/1032877
CVE: CVE-2015-5264
Published: 2016-02-22
Description: The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to bypass intended access restrictions and enter additional answer attempts by leveraging the student role.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50516; http://www.openwall.com/lists/oss-security/2015/09/21/1; http://www.securitytracker.com/id/1033619
CVE: CVE-2015-5265
Published: 2016-02-22
Description: The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki:managefiles capability before authorizing file management, which allows remote authenticated users to delete arbitrary files by using a manage-files button in a text editor.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48371; http://www.openwall.com/lists/oss-security/2015/09/21/1; http://www.securitytracker.com/id/1033619
CVE: CVE-2015-5266
Published: 2016-02-22
Description: The enrol_meta_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to obtain manager privileges in opportunistic circumstances by leveraging incorrect role processing during a long-running sync script.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50744; http://www.openwall.com/lists/oss-security/2015/09/21/1; http://www.securitytracker.com/id/1033619
CVE: CVE-2015-5267
Published: 2016-02-22
Description: lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt_rand function to implement the random_string and complex_random_string functions, which makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-254
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50860; http://www.openwall.com/lists/oss-security/2015/09/21/1; http://www.securitytracker.com/id/1033619
CVE: CVE-2015-5268
Published: 2016-02-22
Description: The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based authorization checks, which allows remote authenticated users to obtain sensitive information by reading a rating value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50173; http://www.openwall.com/lists/oss-security/2015/09/21/1; http://www.securitytracker.com/id/1033619
CVE: CVE-2015-5269
Published: 2016-02-22
Description: Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated users to inject arbitrary web script or HTML via a modified grouping description.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50709; http://www.openwall.com/lists/oss-security/2015/09/21/1; http://www.securitytracker.com/id/1033619
CVE: CVE-2015-5272
Published: 2016-02-22
Description: The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, as demonstrated by a post directed to "all participants."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50576; http://www.openwall.com/lists/oss-security/2015/09/21/1; http://www.securitytracker.com/id/1033619
CVE: CVE-2015-5331
Published: 2016-02-22
Description: Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-254
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426; https://moodle.org/mod/forum/discuss.php?d=323228; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50426
CVE: CVE-2015-5332
Published: 2016-02-22
Description: Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveraging the guest role and entering drafts with the editor-autosave feature.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51000; https://moodle.org/mod/forum/discuss.php?d=323229; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51000
CVE: CVE-2015-5335
Published: 2016-02-22
Description: Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote attackers to hijack the authentication of administrators for requests that send statistics to an arbitrary hub URL.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51091; https://moodle.org/mod/forum/discuss.php?d=323230; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51091
CVE: CVE-2015-5336
Published: 2016-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student role and entering a crafted survey answer.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49940; https://moodle.org/mod/forum/discuss.php?d=323231; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-49940
CVE: CVE-2015-5337
Published: 2016-02-22
Description: Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48085; https://moodle.org/mod/forum/discuss.php?d=323232; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48085
CVE: CVE-2015-5338
Published: 2016-02-22
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allow remote attackers to hijack the authentication of arbitrary users for requests to (1) mod/lesson/mediafile.php or (2) mod/lesson/view.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48109; https://moodle.org/mod/forum/discuss.php?d=323233; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-48109
CVE: CVE-2015-5339
Published: 2016-02-22
Description: The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users to obtain sensitive course-participant information via a web-service request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51861; https://moodle.org/mod/forum/discuss.php?d=323234; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51861
CVE: CVE-2015-5340
Published: 2016-02-22
Description: Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/overview.php or (2) badges/view.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51684; https://moodle.org/mod/forum/discuss.php?d=323235; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51684
CVE: CVE-2015-5341
Published: 2016-02-22
Description: mod_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50837; https://moodle.org/mod/forum/discuss.php?d=323236; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-50837
CVE: CVE-2015-5342
Published: 2016-02-22
Description: The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51569; https://moodle.org/mod/forum/discuss.php?d=323237; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-51569
CVE: CVE-2016-0724
Published: 2016-02-22
Description: The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the moodle/course:viewhiddencourses capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200, CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52072; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176502.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176436.html
CVE: CVE-2016-0725
Published: 2016-02-22
Description: Cross-site scripting (XSS) vulnerability in the search_pagination function in course/classes/management_renderer.php in Moodle 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted search string.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-52552; http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176502.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176436.html
CVE: CVE-2016-2037
Published: 2016-02-22
Description: The cpio_safer_name_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted cpio file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://www.debian.org/security/2016/dsa-3483; http://www.openwall.com/lists/oss-security/2016/01/19/4; http://www.openwall.com/lists/oss-security/2016/01/22/4
CVE: CVE-2016-2232
Published: 2016-02-22
Description: Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3 allow remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a zero length error correcting redundancy packet for a UDPTL FAX packet that is lost.
CVSS Score: 6.5 (MEDIUM)
References: http://downloads.asterisk.org/pub/security/AST-2016-003.html; http://www.debian.org/security/2016/dsa-3700; http://www.securitytracker.com/id/1034931