Re: CVE Request: moodle 1.9.8, 1.8.2

[Ludwig Nussel <ludwig.nussel () suse de>]

Josh Bressers wrote:
> ----- "Ludwig Nussel" <ludwig.nussel () suse de> wrote:
> > Moodle 1.9.8 and 1.8.12 were released with security fixes:
> > http://docs.moodle.org/en/Moodle_1.9.8_release_notes
> > * MSA-10-0001 Vulnerability in KSES text cleaning
> > * MSA-10-0002 XSS vulnerabilty in the phpcas module
> > * MSA-10-0003 Disclosure of full user names
> > * MSA-10-0004 Improved access control in course restore
> > * MSA-10-0005 Incorrect validation of forms data
> > * MSA-10-0006 SQL injection in Wiki module
> > * MSA-10-0007 Reflective Cross Site Scripting (XSS) in the Moodle
> > Global Search Engine
> > * MSA-10-0008 Persistent XSS when using Login-as feature
> > * MSA-10-0009 Session fixation prevention now turned on by default
>
> Steve,
>
> I'm going to defer this one to MITRE.

Just a reminder :-)

cu
Ludwig

-- 
 (o_   Ludwig Nussel
 //\   
 V_/_  http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)