[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201004231459.53135.ludwig.nussel@suse.de>
Date: Fri, 23 Apr 2010 14:59:52 +0200
From: Ludwig Nussel <ludwig.nussel@...e.de>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request: moodle 1.9.8, 1.8.2
Josh Bressers wrote:
> ----- "Ludwig Nussel" <ludwig.nussel@...e.de> wrote:
> > Moodle 1.9.8 and 1.8.12 were released with security fixes:
> > http://docs.moodle.org/en/Moodle_1.9.8_release_notes
> > * MSA-10-0001 Vulnerability in KSES text cleaning
> > * MSA-10-0002 XSS vulnerabilty in the phpcas module
> > * MSA-10-0003 Disclosure of full user names
> > * MSA-10-0004 Improved access control in course restore
> > * MSA-10-0005 Incorrect validation of forms data
> > * MSA-10-0006 SQL injection in Wiki module
> > * MSA-10-0007 Reflective Cross Site Scripting (XSS) in the Moodle
> > Global Search Engine
> > * MSA-10-0008 Persistent XSS when using Login-as feature
> > * MSA-10-0009 Session fixation prevention now turned on by default
>
> Steve,
>
> I'm going to defer this one to MITRE.
Just a reminder :-)
cu
Ludwig
--
(o_ Ludwig Nussel
//\
V_/_ http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
