Published: 25/03/2008 Updated: 01/12/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare prior to 1.4.003, Moodle prior to 1.8.5, and other products, allows remote malicious users to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.

Vulnerable Product	Search on Vulmon	Subscribe to Product
moodle moodle 1.8.1
moodle moodle 1.6.7
moodle moodle 1.5.0
moodle moodle 1.5.3
moodle moodle 1.4.2
moodle moodle 1.4.1
moodle moodle 1.2.0
moodle moodle 1.1.1
moodle moodle
moodle moodle 1.7.4
moodle moodle 1.7.3
moodle moodle 1.6.4
moodle moodle 1.6.3
moodle moodle 1.6.2
moodle moodle 1.5
moodle moodle 1.4.5
moodle moodle 1.3.2
moodle moodle 1.3.1
egroupware egroupware 1.0.3
egroupware egroupware 1.0.1
moodle moodle 1.7.6
moodle moodle 1.7.5
moodle moodle 1.6.6
moodle moodle 1.6.5
moodle moodle 1.5.2
moodle moodle 1.5.1
moodle moodle 1.3.4
moodle moodle 1.3.3
egroupware egroupware 1.4.001
egroupware egroupware 1.2.106-2
egroupware egroupware 1.0.6
moodle moodle 1.8.3
moodle moodle 1.8.2
moodle moodle 1.7.2
moodle moodle 1.7.1
moodle moodle 1.6.1
moodle moodle 1.6.0
moodle moodle 1.4.4
moodle moodle 1.4.3
moodle moodle 1.3.0
moodle moodle 1.2.1
egroupware egroupware 1.0
egroupware egroupware

Lukasz Pilorz discovered that the HTML filtering used in Moodle was not strict enough A remote attacker could send malicious requests to Moodle and execute arbitrary code as the web server user ...

Several remote vulnerabilities have been discovered in Moodle, an online course management system The following issues are addressed in this update, ranging from cross site scripting to remote code execution Various cross site scripting issues in the Moodle codebase (CVE-2008-3326, CVE-2008-3325, CVE-2007-3555, CVE-2008-5432, MSA-08-0021, MDL-884 ...

Several vulnerabilities have been discovered in wordpress, weblog manager The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-6762 It was discovered that wordpress is prone to an open redirect vulnerability which allows remote attackers to conduct phishing atacks CVE-2008-6767 It was discovered that remot ...

Debian Bug report logs - #504771 wordpress can be subject of delayed attacks via cookies Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Raphael Geissert <atomo64@gmailcom> Date: Fri, 7 Nov 2008 02:42:04 UTC S ...

Debian Bug report logs - #536724 wordpress: CORE-2009-0515 priviledges unchecked and multiple information disclosures Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: "Michael S Gilbert" <michaelsgilbert@gmailcom&g ...

Debian Bug report logs - #531736 CVE-2008-6767, CVE-2008-6762 Package: wordpress; Maintainer for wordpress is Craig Small <csmall@debianorg>; Source for wordpress is src:wordpress (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iuculanoit> Date: Wed, 3 Jun 2009 17:27:02 UTC Severity: normal Tags: s ...

CVE-2008-1502

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect