Linux Kernel vulnerability CVE-2021-23134 Security Advisory Security Advisory Description Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.4 allows local attackers to ...
More info:
https://support.f5.com/csp/article/K52102651?utm_source=f5support&utm_medium=RSS
di Michael Hawkins. Insufficient capability checks made it possible to fetch other users calendar action events.Severity/Risk:MinorVersions affected:3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versionsVersions fixed:3.11.4, 3.10.8 and 3.9.11Reported by:0xkasperCVE identifier:CVE-2021-43560Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71918Tracker issue:MDL-71918 IDOR in a calendar web service allows fetching of
More info:
https://moodle.org/mod/forum/discuss.php?d=429100&parent=1726807
di Michael Hawkins. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.Severity/Risk:SeriousVersions affected:3.11 to 3.11.4Versions fixed:3.11.5Reported by:Paul HoldenCVE identifier:CVE-2022-0332Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72573Tracker issue:MDL-72573 SQL injection risk in code fetching h5p activity user attempts
More info:
https://moodle.org/mod/forum/discuss.php?d=431099&parent=1734813
di Michael Hawkins. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.Severity/Risk:MinorVersions affected:3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versionsVersions fixed:3.11.5, 3.10.9 and 3.9.12Reported by:oct0pus7CVE identifier:CVE-2022-0333Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71239Tracker
More info:
https://moodle.org/mod/forum/discuss.php?d=431100&parent=1734814
di Michael Hawkins. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.Severity/Risk:MinorVersions affected:3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versionsVersions fixed:3.11.5, 3.10.9 and 3.9.12Reported by:Deds CastilloCVE identifier:CVE-2022-0334Changes
More info:
https://moodle.org/mod/forum/discuss.php?d=431102&parent=1734816
di Michael Hawkins. An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.NOTE: Please pay particular attention to this fix. Information was recently released online about this vulnerability by third parties, so please upgrade or patch as soon as you are able to. We prepared the patch for this as soon as we became aware of the issue, to ensure a fix was available for this release.It
More info:
https://moodle.org/mod/forum/discuss.php?d=432947&parent=1742073
di Michael Hawkins. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.Severity/Risk:SeriousVersions affected:3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versionsVersions fixed:3.11.5, 3.10.9 and 3.9.12Reported by:OstapbenderCVE identifier:CVE-2022-0335Changes (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-72367Tracker issue:MDL-72367 CSRF risk in badge
More info:
https://moodle.org/mod/forum/discuss.php?d=431103&parent=1734817
di Michael Hawkins. Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.Severity/Risk:MinorVersions affected:3.11 to 3.11.5, 3.10 to 3.10.9, 3.9 to 3.9.12 and earlier unsupported versionsVersions fixed:3.11.6, 3.10.10 and 3.9.13Reported by:Andrew LyonsWorkaround:Remove the moodle/badges:configurecriteria capability from users to prevent them
More info:
https://moodle.org/mod/forum/discuss.php?d=432949&parent=1742075
di Michael Hawkins. Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.Severity/Risk:MinorVersions affected:3.11 to 3.11.5, 3.10 to 3.10.9, 3.9 to 3.9.12 and earlier unsupported versionsVersions fixed:3.11.6, 3.10.10 and 3.9.13Reported by:Chris PrattWorkaround:Remove the moodle/site:uploadusers capability from users who do not also have the moodle/user:delete capability, until
More info:
https://moodle.org/mod/forum/discuss.php?d=432948&parent=1742074
di Michael Hawkins. The PHPMailer library included with Moodle has been upgraded to the latest version, which includes security fixes.Severity/Risk:MinorVersions affected:3.11 to 3.11.5, 3.10 to 3.10.9, 3.9 to 3.9.12 and earlier unsupported versionsVersions fixed:3.11.6, 3.10.10 and 3.9.13Reported by:Sara Arjona (@sarjona)CVE identifier:N/AChanges (master):http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-71703Tracker issue:MDL-71703 Upgrade PHPMailer to
More info:
https://moodle.org/mod/forum/discuss.php?d=432950&parent=1742077
