# CVEs published 2012-07-20

17 CVEs were published on July 20, 2012: 0 critical, 0 high. Days are UTC.

- [CVE-2011-4581](https://cve.now/CVE-2011-4581.md): mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wik (no CVSS)
- [CVE-2011-4582](https://cve.now/CVE-2011-4582.md): Open redirect vulnerability in the Calendar set page in Moodle 2.1.x before 2.1.3 allows remote authenticated users to redirect users to arb (no CVSS, moodle/moodle)
- [CVE-2011-4583](https://cve.now/CVE-2011-4583.md): Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1) disabled services and (2) users who no long (no CVSS)
- [CVE-2011-4584](https://cve.now/CVE-2011-4584.md): The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated (no CVSS)
- [CVE-2011-4585](https://cve.now/CVE-2011-4585.md): login/change\_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is ena (no CVSS)
- [CVE-2011-4586](https://cve.now/CVE-2011-4586.md): CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x befo (no CVSS)
- [CVE-2011-4587](https://cve.now/CVE-2011-4587.md): lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in (no CVSS)
- [CVE-2011-4588](https://cve.now/CVE-2011-4588.md): The ip\_in\_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to (no CVSS)
- [CVE-2011-4589](https://cve.now/CVE-2011-4589.md): backup/moodle2/restore\_stepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber (no CVSS)
- [CVE-2011-4590](https://cve.now/CVE-2011-4590.md): The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state an (no CVSS)
- [CVE-2011-4591](https://cve.now/CVE-2011-4591.md): Cross-site scripting (XSS) vulnerability in the print\_object function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 (no CVSS)
- [CVE-2011-4592](https://cve.now/CVE-2011-4592.md): The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which (no CVSS)
- [CVE-2011-4593](https://cve.now/CVE-2011-4593.md): Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/action\_redir group messages, which allo (no CVSS)
- [CVE-2012-2688](https://cve.now/CVE-2012-2688.md): Unspecified vulnerability in the \_php\_stream\_scandir function in the stream implementation in PHP before 5.3.15 and 5.4.x before 5.4.5 has u (no CVSS)
- [CVE-2012-2955](https://cve.now/CVE-2012-2955.md): Multiple cross-site scripting (XSS) vulnerabilities in the administrative user interface in IBM Lotus Protector for Mail Security 2.1, 2.5, (no CVSS)
- [CVE-2012-3008](https://cve.now/CVE-2012-3008.md): Stack-based buffer overflow in OSIsoft PI OPC DA Interface before 2.3.20.9 allows remote authenticated users to execute arbitrary code by se (no CVSS)
- [CVE-2012-3365](https://cve.now/CVE-2012-3365.md): The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open\_basedir protection mechanism via unspecified vector (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2012-07-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.