Latest upstream release for this branch. Correct unbundling of php-pear-HTML-Quickform. Fix for: MSA-13-0025: XSS vulnerability in YUI library MSA-13-0026: Personal information leak in IMS-LTI CVE-2013-2242 MSA-13-0027: Access issue in Chat module CVE-2013-2243 MSA-13-0028: Answer information revealed in Lesson activity CVE-2013-2244 MSA-13-0029: XSS risk in conditional activities CVE-2013-2245 MSA-13-0030: Information leak through RSS CVE-2013-2246 MSA-13-0031: Personal information leak in Feedback activity

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

このブランチ用の最新 Upstream リリース。php-pear-HTML-Quickform の適切なバンドル解除。修正：MSA-13-0025：YUI ライブラリにある XSS の脆弱性 MSA-13-0026：IMS-LTI における個人情報の漏洩 CVE-2013-2242 MSA-13-0027：Chat モジュールにあるアクセスの問題 CVE-2013-2243 MSA-13-0028：レッスン活動で漏洩した回答情報 CVE-2013-2244 MSA-13-0029：条件付き活動にある XSS のリスク CVE-2013-2245 MSA-13-0030：RSS を通じた情報漏洩 CVE-2013-2246 MSA-13-0031：フィードバック活動における個人情報の漏洩

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

该分支的最新上游版本。正确解绑 php-pear-HTML-Quickform。补丁：MSA-13-0025：YUI 库中的 XSS 漏洞 MSA-13-0026：IMS-LTI 中的个人信息泄漏 CVE-2013-2242 MSA-13-0027：Chat 模块中的访问权限问题 CVE-2013-2243 MSA-13-0028：课程活动中泄漏的回答信息 CVE-2013-2244 MSA-13-0029：条件活动中的 XSS 风险 CVE-2013-2245 MSA-13-0030：通过 RSS 造成的信息泄漏 CVE-2013-2246 MSA-13-0031：反馈活动中的个人信息泄漏

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

此分支的最新上游版本。更正取消隨附 php-pear-HTML-Quickform。修正：MSA-13-0025：YUI 程式庫中的 XSS 弱點 MSA-13-0026：IMS-LTI 中的個人資訊洩漏 CVE-2013-2242 MSA-13-0027：交談模組中的存取問題 CVE-2013-2243 MSA-13-0028：課程活動中顯示的答案資訊 CVE-2013-2244 MSA-13-0029：條件式活動中的 XSS 風險 CVE-2013-2245 MSA-13-0030：透過 RSS 發生的資訊洩漏 CVE-2013-2246 MSA-13-0031：意見反饋活動中的個人資訊洩漏

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.2.x prior to 2.2.11 are exposed to the following vulnerabilities :

 - A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access.  This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'.  This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
 - A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.3.x prior to 2.3.8 are exposed to the following vulnerabilities :

 - A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access.  This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program failing to properly restrict users using view source on pages.  This may allow a remote attacker to gain access to answer information by obtaining ID values for Lesson activity matching questions. (CVE-2013-2243)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'.  This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
 - A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.4.x prior to 2.4.5 or 2.5.x prior to 2.5.1 are exposed to the following vulnerabilities :

 - A flaw exists in 'mod/chat/gui_sockets/index.php' that is due to the program failing to properly check for access.  This may allow a remote attacker to access a daemon-mode Chat activity without proper permissions. (CVE-2013-2242)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program failing to properly restrict users using view source on pages.  This may allow a remote attacker to gain access to answer information by obtaining ID values for Lesson activity matching questions. (CVE-2013-2243)
 - A flaw exists that allows a remote cross-site scripting (XSS) attack.  This flaw exists because the application does not validate input passed via the Conditional Activities 'user' field before returning it to the user.  This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. (CVE-2013-2244)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to block information related to the person being impersonated being shown shown along with an error message when an attacker is attempting to impersonate another user using RSS tokens.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-2245)
 - A flaw exists that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the feedback module failing to properly check for privileges in 'feedback/lib.php'.  This will result in personal information being exposed to a remote attacker. (CVE-2013-2246)
 - A flaw exists in the IMS-LTI (External tool) module that may lead to the unauthorized disclosure of sensitive information.  The issue is due to the program not allowing users to change privacy settings, which will result in personal information always being transferred.  This may allow a remote attacker to gain access to sensitive information. (CVE-2013-4938)

ID	名稱	產品	系列	已發布	已更新	嚴重性
69007	Fedora 19 : moodle-2.4.5-2.fc19 (2013-12964)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69007	Fedora 19：moodle-2.4.5-2.fc19（2013-12964）	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69007	Fedora 19：moodle-2.4.5-2.fc19 (2013-12964)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69007	Fedora 19：moodle-2.4.5-2.fc19 (2013-12964)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69006	Fedora 18 : moodle-2.3.8-2.fc18 (2013-12950)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69150	Fedora 17 : moodle-2.2.11-1.fc17 (2013-13252)	Nessus	Fedora Local Security Checks	2013/7/31	2021/1/11	medium
69006	Fedora 18：moodle-2.3.8-2.fc18（2013-12950）	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69150	Fedora 17：moodle-2.2.11-1.fc17（2013-13252）	Nessus	Fedora Local Security Checks	2013/7/31	2021/1/11	medium
69006	Fedora 18：moodle-2.3.8-2.fc18 (2013-12950)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69150	Fedora 17：moodle-2.2.11-1.fc17 (2013-13252)	Nessus	Fedora Local Security Checks	2013/7/31	2021/1/11	medium
69006	Fedora 18：moodle-2.3.8-2.fc18 (2013-12950)	Nessus	Fedora Local Security Checks	2013/7/23	2021/1/11	medium
69150	Fedora 17：moodle-2.2.11-1.fc17 (2013-13252)	Nessus	Fedora Local Security Checks	2013/7/31	2021/1/11	medium
9415	Moodle 2.2.x < 2.2.11 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	medium
9416	Moodle 2.3.x < 2.3.8 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	medium
9417	Moodle 2.4.x < 2.4.5 / 2.5.x < 2.5.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium