The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.6.x prior to 2.6.11, and 2.7.x prior to 2.7.8 are exposed to the following vulnerabilities :

 - A flaw exists in Quiz manual-grading that is due to the program failing to use the Cross-Site Scripting (XSS) mask flag 'mod/quiz:grade'.  This may result in administrators being unaware that this is a trusted action that represents an XSS risk. (CVE-2015-3174)
 - A flaw exists in the 'get_referer()' function that is triggered when using 'redirect()', which can cause some error messages in the display button to return to the previous page.  This may allow a context-dependent attacker to conduct phishing attacks. (CVE-2015-3175)
 - A flaw exists on sites with enabled self-registration that may allow a remote attacker to gain access to user fullname through account confirmation links. (CVE-2015-3176)
 - A flaw exists that allows a XSS attack.  This flaw exists because the 'external_format_text()' function does not validate input when displaying it to other users in the external application.  This may allow an authenticated remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between the browser and the server. (CVE-2015-3178)
 - A flaw exists when self-registration is enabled that may allow a user who was suspended after creating their account, but before confirming it, to login a single time after account confirmation. (CVE-2015-3179)
 - A flaw exists that may allow an authenticated remote attacker with suspended enrollment to gain access to the course structure in the navigation block.  This may allow the attacker to gain unauthorized access to information. (CVE-2015-3180)
 - A flaw exists that may result in permissions not being properly removed when manageownfiles permissions are revoked from a user. This may allow an authenticated remote attacker to upload private files via Web Services. (CVE-2015-3181)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.8.x prior to 2.8.6 are exposed to the following vulnerabilities :

 - A flaw exists in Quiz manual-grading that is due to the program failing to use the Cross-Site Scripting (XSS) mask flag 'mod/quiz:grade'.  This may result in administrators being unaware that this is a trusted action that represents an XSS risk. (CVE-2015-3174)
 - A flaw exists in the 'get_referer()' function that is triggered when using 'redirect()', which can cause some error messages in the display button to return to the previous page.  This may allow a context-dependent attacker to conduct phishing attacks. (CVE-2015-3175)
 - A flaw exists on sites with enabled self-registration that may allow a remote attacker to gain access to user fullname through account confirmation links. (CVE-2015-3176)
 - A flaw exists that is due to the program allowing users to subscribe themselves to site wide events.  This may allow an authenticated remote attacker to gain access to potentially sensitive information. (CVE-2015-3177)
 - A flaw exists that allows a XSS attack.  This flaw exists because the 'external_format_text()' function does not validate input when displaying it to other users in the external application.  This may allow an authenticated remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between the browser and the server. (CVE-2015-3178)
 - A flaw exists when self-registration is enabled that may allow a user who was suspended after creating their account, but before confirming it, to login a single time after account confirmation. (CVE-2015-3179)
 - A flaw exists that may allow an authenticated remote attacker with suspended enrollment to gain access to the course structure in the navigation block.  This may allow the attacker to gain unauthorized access to information. (CVE-2015-3180)
 - A flaw exists that may result in permissions not being properly removed when manageownfiles permissions are revoked from a user. This may allow an authenticated remote attacker to upload private files via Web Services. (CVE-2015-3181)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before
    2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-
    site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading. (CVE-2015-3174)

moodle-2.7.9-1.fc21 - 2.7.9。

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

moodle-2.8.7-1.fc22 - 最新上游版本。

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

moodle-2.9.1-1.fc23 - 2.9.1

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

moodle-2.7.9-1.fc21 - 2.7.9.

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

moodle-2.8.7-1.fc22 - 最新上游版本。

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

moodle-2.9.1-1.fc23 - 2.9.1

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

moodle-2.7.9-1.fc21 - 2.7.9。

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

moodle-2.8.7-1.fc22 - 最新の Upstream リリース。

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

moodle-2.9.1-1.fc23 - 2.9.1

注意：Tenable Network Security は、前述の記述ブロックを Fedora セキュリティアドバイザリから直接抽出しています。Tenable では、できる限り新たな問題を持ち込まないように、自動的に整理して書式設定するようにしています。

moodle-2.7.9-1.fc21 - 2.7.9.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

moodle-2.8.7-1.fc22 - Latest upstream release.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

moodle-2.9.1-1.fc23 - 2.9.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
9426	Moodle 2.6.x < 2.6.11 / 2.7.x < 2.7.8 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	critical
9425	Moodle 2.8.x < 2.8.6 Multiple Vulnerabilities	Nessus Network Monitor	CGI	2016/7/21	2019/3/6	critical
433762	SCA: security update for moodle/moodle (GHSA-6r7x-6q98-qcqp)	Tenable Self-Hosted Container Security	SCA Checks	2025/8/19	2026/7/2	medium
433762	SCA: security update for moodle/moodle (GHSA-6r7x-6q98-qcqp)	Tenable Cloud Security	SCA Checks	2025/8/19	2026/7/2	medium
85956	Fedora 21：moodle-2.7.9-1.fc21 (2015-14996)	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
85955	Fedora 22：moodle-2.8.7-1.fc22 (2015-14988)	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
86032	Fedora 23：moodle-2.9.1-1.fc23 (2015-14987)	Nessus	Fedora Local Security Checks	2015/9/21	2021/1/11	high
85956	Fedora 21：moodle-2.7.9-1.fc21 (2015-14996)	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
85955	Fedora 22：moodle-2.8.7-1.fc22 (2015-14988)	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
86032	Fedora 23：moodle-2.9.1-1.fc23 (2015-14987)	Nessus	Fedora Local Security Checks	2015/9/21	2021/1/11	high
85956	Fedora 21：moodle-2.7.9-1.fc21（2015-14996）	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
85955	Fedora 22：moodle-2.8.7-1.fc22（2015-14988）	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
86032	Fedora 23：moodle-2.9.1-1.fc23（2015-14987）	Nessus	Fedora Local Security Checks	2015/9/21	2021/1/11	high
85956	Fedora 21 : moodle-2.7.9-1.fc21 (2015-14996)	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
85955	Fedora 22 : moodle-2.8.7-1.fc22 (2015-14988)	Nessus	Fedora Local Security Checks	2015/9/16	2021/1/11	high
86032	Fedora 23 : moodle-2.9.1-1.fc23 (2015-14987)	Nessus	Fedora Local Security Checks	2015/9/21	2021/1/11	high

检测

插件搜索

critical

critical

medium

medium

high

high

high

high

high

high

high

high

high

high

high

high