# CVEs published 2016-02-22 27 CVEs were published on February 22, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-2037](https://cve.now/CVE-2016-2037.md): The cpio\_safer\_name\_suffix function in util.c in cpio 2.11 allows remote attackers to cause a denial of service (out-of-bounds write) via a (no CVSS) - [CVE-2016-2232](https://cve.now/CVE-2016-2232.md): Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13 (no CVSS) - [CVE-2016-2316](https://cve.now/CVE-2016-2316.md): chan\_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-ce (no CVSS) - [CVE-2016-2536](https://cve.now/CVE-2016-2536.md): Multiple use-after-free vulnerabilities in SAP 3D Visual Enterprise Viewer allow remote attackers to execute arbitrary code via a crafted Sk (no CVSS) - [CVE-2015-3272](https://cve.now/CVE-2015-3272.md): Open redirect vulnerability in the clean\_param function in lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8. (no CVSS, moodle/moodle) - [CVE-2015-3273](https://cve.now/CVE-2015-3273.md): mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy (no CVSS) - [CVE-2015-3274](https://cve.now/CVE-2015-3274.md): Cross-site scripting (XSS) vulnerability in the user\_get\_user\_details function in user/lib.php in Moodle through 2.6.11, 2.7.x before 2.7.9, (no CVSS, moodle/moodle) - [CVE-2015-3275](https://cve.now/CVE-2015-3275.md): Multiple cross-site scripting (XSS) vulnerabilities in the SCORM module in Moodle through 2.6.11, 2.7.x before 2.7.9, 2.8.x before 2.8.7, an (no CVSS, moodle/moodle) - [CVE-2015-5264](https://cve.now/CVE-2015-5264.md): The lesson module in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 allows remote authenticated user (no CVSS, moodle/moodle) - [CVE-2015-5265](https://cve.now/CVE-2015-5265.md): The wiki component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 does not consider the mod/wiki: (no CVSS, moodle/moodle) - [CVE-2015-5266](https://cve.now/CVE-2015-5266.md): The enrol\_meta\_sync function in enrol/meta/locallib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before (no CVSS, moodle/moodle) - [CVE-2015-5267](https://cve.now/CVE-2015-5267.md): lib/moodlelib.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 relies on the PHP mt\_rand functi (no CVSS, moodle/moodle) - [CVE-2015-5268](https://cve.now/CVE-2015-5268.md): The rating component in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x before 2.9.2 mishandles group-based author (no CVSS, moodle/moodle) - [CVE-2015-5269](https://cve.now/CVE-2015-5269.md): Cross-site scripting (XSS) vulnerability in group/overview.php in Moodle through 2.6.11, 2.7.x before 2.7.10, 2.8.x before 2.8.8, and 2.9.x (no CVSS, moodle/moodle) - [CVE-2015-5272](https://cve.now/CVE-2015-5272.md): The Forum module in Moodle 2.7.x before 2.7.10 allows remote authenticated users to post to arbitrary groups by leveraging the teacher role, (no CVSS) - [CVE-2015-5331](https://cve.now/CVE-2015-5331.md): Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticate (no CVSS, moodle/moodle) - [CVE-2015-5332](https://cve.now/CVE-2015-5332.md): Atto in Moodle 2.8.x before 2.8.9 and 2.9.x before 2.9.3 allows remote attackers to cause a denial of service (disk consumption) by leveragi (no CVSS) - [CVE-2015-5335](https://cve.now/CVE-2015-5335.md): Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x befo (no CVSS, moodle/moodle) - [CVE-2015-5336](https://cve.now/CVE-2015-5336.md): Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, (no CVSS, moodle/moodle) - [CVE-2015-5337](https://cve.now/CVE-2015-5337.md): Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowpl (no CVSS, moodle/moodle) - [CVE-2015-5338](https://cve.now/CVE-2015-5338.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before (no CVSS, moodle/moodle) - [CVE-2015-5339](https://cve.now/CVE-2015-5339.md): The core\_enrol\_get\_enrolled\_users web service in enrol/externallib.php in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, an (no CVSS, moodle/moodle) - [CVE-2015-5340](https://cve.now/CVE-2015-5340.md): Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capabi (no CVSS, moodle/moodle) - [CVE-2015-5341](https://cve.now/CVE-2015-5341.md): mod\_scorm in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 mishandles availability dates, which all (no CVSS, moodle/moodle) - [CVE-2015-5342](https://cve.now/CVE-2015-5342.md): The choice module in Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 allows remote authenticated user (no CVSS, moodle/moodle) - [CVE-2016-0724](https://cve.now/CVE-2016-0724.md): The (1) core\_enrol\_get\_course\_enrolment\_methods and (2) enrol\_self\_get\_instance\_info web services in Moodle through 2.6.11, 2.7.x before 2.7 (no CVSS, moodle/moodle) - [CVE-2016-0725](https://cve.now/CVE-2016-0725.md): Cross-site scripting (XSS) vulnerability in the search\_pagination function in course/classes/management\_renderer.php in Moodle 2.8.x before (no CVSS, moodle/moodle) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-02-22 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.