# CVEs published 2015-06-01 25 CVEs were published on June 1, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-0211](https://cve.now/CVE-2015-0211.md): mod/lti/ajax.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 does not consider the moodle/course (no CVSS, moodle/moodle) - [CVE-2015-0212](https://cve.now/CVE-2015-0212.md): Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x be (no CVSS, moodle/moodle) - [CVE-2015-0213](https://cve.now/CVE-2015-0213.md): Multiple cross-site request forgery (CSRF) vulnerabilities in (1) editcategories.html and (2) editcategories.php in the Glossary module in M (no CVSS, moodle/moodle) - [CVE-2015-0214](https://cve.now/CVE-2015-0214.md): message/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated (no CVSS, moodle/moodle) - [CVE-2015-0215](https://cve.now/CVE-2015-0215.md): calendar/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated (no CVSS, moodle/moodle) - [CVE-2015-0216](https://cve.now/CVE-2015-0216.md): access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK\_XSS bit for graders, which allows remote authenticated us (no CVSS, moodle/moodle) - [CVE-2015-0217](https://cve.now/CVE-2015-0217.md): filter/mediaplugin/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenti (no CVSS, moodle/moodle) - [CVE-2015-0218](https://cve.now/CVE-2015-0218.md): Cross-site request forgery (CSRF) vulnerability in auth/shibboleth/logout.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7. (no CVSS, moodle/moodle) - [CVE-2015-1493](https://cve.now/CVE-2015-1493.md): Directory traversal vulnerability in the min\_get\_slash\_argument function in lib/configonlylib.php in Moodle through 2.5.9, 2.6.x before 2.6. (no CVSS, moodle/moodle) - [CVE-2015-2266](https://cve.now/CVE-2015-2266.md): message/index.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/site: (no CVSS, moodle/moodle) - [CVE-2015-2267](https://cve.now/CVE-2015-2267.md): mdeploy.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to byp (no CVSS, moodle/moodle) - [CVE-2015-2268](https://cve.now/CVE-2015-2268.md): filter/urltolink/filter.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authentica (no CVSS, moodle/moodle) - [CVE-2015-2269](https://cve.now/CVE-2015-2269.md): Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2. (no CVSS, moodle/moodle) - [CVE-2015-2270](https://cve.now/CVE-2015-2270.md): lib/moodlelib.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4, when the theme uses the blocks-re (no CVSS, moodle/moodle) - [CVE-2015-2271](https://cve.now/CVE-2015-2271.md): tag/user.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 does not consider the moodle/tag:flag c (no CVSS, moodle/moodle) - [CVE-2015-2272](https://cve.now/CVE-2015-2272.md): login/token.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to (no CVSS, moodle/moodle) - [CVE-2015-2273](https://cve.now/CVE-2015-2273.md): Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics\_question\_table.php in Moodle through 2.5.9, 2.6.x before 2 (no CVSS, moodle/moodle) - [CVE-2015-3174](https://cve.now/CVE-2015-3174.md): mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK\_XSS bi (no CVSS, moodle/moodle) - [CVE-2015-3175](https://cve.now/CVE-2015-3175.md): Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote (no CVSS, moodle/moodle) - [CVE-2015-3176](https://cve.now/CVE-2015-3176.md): The account-confirmation feature in login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8 (no CVSS, moodle/moodle) - [CVE-2015-3177](https://cve.now/CVE-2015-3177.md): Moodle 2.8.x before 2.8.6 does not consider the tool/monitor:subscribe capability before entering subscriptions to site-wide event-monitor r (no CVSS) - [CVE-2015-3178](https://cve.now/CVE-2015-3178.md): Cross-site scripting (XSS) vulnerability in the external\_format\_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2 (no CVSS, moodle/moodle) - [CVE-2015-3179](https://cve.now/CVE-2015-3179.md): login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users (no CVSS, moodle/moodle) - [CVE-2015-3180](https://cve.now/CVE-2015-3180.md): lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated u (no CVSS, moodle/moodle) - [CVE-2015-3181](https://cve.now/CVE-2015-3181.md): files/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not consider the moodle/ (no CVSS, moodle/moodle) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-06-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.