Marina Glancy reports :

- MSA-16-0019: Glossary search displays entries without checking user permissions to view them

- MSA-16-0020: Text injection in email headers

- MSA-16-0021: Unenrolled user still receives event monitor notifications even though they can no longer access course

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can     no longer access the course. (CVE-2016-5014)

Note that Nessus relies on the presence of the package as reported by the vendor.

Marina Glancy 氏の報告：

- MSA-16-0019：用語集検索では、ユーザーの表示許可をチェックせずに、エントリを表示します

- MSA-16-0020：電子メールヘッダーでのテキストの注入

- MSA-16-0021：未登録のユーザーは、コースにすでにアクセスできなくても、イベントモニター通知を引き続き受信します

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Moodle 2.x および 3.xでは、未登録のユーザーはコースにすでにアクセスできなくても、イベントモニター通知を引き続き受信します。CVE-2016-5014

Nessus は、ベンダーによって報告されたパッケージの存在に依存していることに注意してください。

Marina Glancy 報告：

- MSA-16-0019：Glossary 搜尋會在未檢查使用者檢視項目權限的情況下顯示項目

- MSA-16-0020：在電子郵件標頭中插入文字

- MSA-16-0021：即使未註冊的使用者無法再存取課程，仍會收到事件監控通知

Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - 在 Moodle 2.x 和 3.x中未註冊的使用者即使無法再存取課程仍會收到事件監控通知。 (CVE-2016-5014)

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Marina Glancy 报告：

- MSA-16-0019：Glossary 搜索功能会在未检查用户是否有查看权限的情况下显示条目

- MSA-16-0020：在电子邮件标头中注入文本

- MSA-16-0021：即使未注册的用户无法再访问课程，仍会收到事件监控通知

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - 在 Moodle 中 2.x 和 3.x取消注册的用户即使无法再访问课程仍会收到事件监控通知。 (CVE-2016-5014)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 3.0.x prior to 3.0.5 are exposed to the following vulnerabilities :

 - A flaw exists that may allow an authenticated remote attacker to inject email addresses into the intended recipients of an email by changing their username to include another user's email address.  This may result in other users potentially being saturated with emails. (CVE-2016-5013)
 - A flaw exists in the event monitor tool that is triggered as notifications are still sent to users even after they can no longer access classes.  This may allow an authenticated remote attacker to gain access to sensitive information in notifications. (CVE-2016-5014)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 3.1.x prior to 3.1.1 are exposed to the following vulnerabilities :

 - A flaw exists that is due to the program failing to perform permission checks on Glossary searches.  This may allow a remote attacker to view entries via a glossary search. (CVE-2016-5012)
 - A flaw exists that may allow an authenticated remote attacker to inject email addresses into the intended recipients of an email by changing their username to include another user's email address.  This may result in other users potentially being saturated with emails. (CVE-2016-5013)
 - A flaw exists in the event monitor tool that is triggered as notifications are still sent to users even after they can no longer access classes.  This may allow an authenticated remote attacker to gain access to sensitive information in notifications. (CVE-2016-5014)

The remote web server hosts Moodle, an open-source course management system.  Versions of Moodle 2.9.x prior to 2.9.7 are exposed to the following vulnerabilities :

 - A flaw exists that may allow an authenticated remote attacker to inject email addresses into the intended recipients of an email by changing their username to include another user's email address.  This may result in other users potentially being saturated with emails. (CVE-2016-5013)
 - A flaw exists in the event monitor tool that is triggered as notifications are still sent to users even after they can no longer access classes.  This may allow an authenticated remote attacker to gain access to sensitive information in notifications. (CVE-2016-5014)

ID	Name	Product	Family	Published	Updated	Severity
92770	FreeBSD : moodle -- multiple vulnerabilities (3ddcb42b-5b78-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
264299	Linux Distros Unpatched Vulnerability : CVE-2016-5014	Nessus	Misc.	9/10/2025	9/10/2025	medium
92770	FreeBSD：moodle -- 複数の脆弱性（3ddcb42b-5b78-11e6-b334-002590263bf5）	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
264299	Linux Distros のパッチ未適用の脆弱性: CVE-2016-5014	Nessus	Misc.	9/10/2025	9/10/2025	medium
92770	FreeBSD：moodle -- 多個弱點 (3ddcb42b-5b78-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
264299	Linux Distros 未修補的弱點：CVE-2016-5014	Nessus	Misc.	9/10/2025	9/10/2025	medium
92770	FreeBSD：moodle -- 多种漏洞 (3ddcb42b-5b78-11e6-b334-002590263bf5)	Nessus	FreeBSD Local Security Checks	8/8/2016	1/4/2021	medium
264299	Linux Distros 未修补的漏洞：CVE-2016-5014	Nessus	Misc.	9/10/2025	9/10/2025	medium
9522	Moodle 3.0.x < 3.0.5 Multiple Vulnerabilities	Nessus Network Monitor	CGI	8/25/2016	3/6/2019	medium
9523	Moodle < 3.1.1 Multiple Vulnerabilities	Nessus Network Monitor	CGI	8/25/2016	3/6/2019	medium
9521	Moodle 2.9.x < 2.9.7 Multiple Vulnerabilities	Nessus Network Monitor	CGI	8/25/2016	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium