moodle - several vulnerabilities

Fixed packages 1

Vulnerabilities 13

• Unscored —
  CVE-2009-4300

  Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for p…

  Dec 16, 2009
• Unscored —
  CVE-2009-4304

  Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier …

  Dec 16, 2009
• Medium —
  CVE-2010-1613

  Moodle Session Fixation vulnerability

  Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

  moodle/moodle Packagist
  Apr 29, 2010
• Low —
  CVE-2010-1614

  Moodle vulnerable to Cross-site Scripting

  Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is ena…

  moodle/moodle Packagist
  Apr 29, 2010
• High —
  CVE-2010-1615

  Moodle vulnerable to SQL injection

  Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data valid…

  moodle/moodle Packagist
  Apr 29, 2010
• Medium —
  CVE-2010-1616

  Moodle is vulnerable to unauthorized new accounts creation

  Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.

  moodle/moodle Packagist
  Apr 29, 2010
• Low —
  CVE-2010-1617

  Moodle doesn't properly check role

  user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.

  moodle/moodle Packagist
  Apr 29, 2010
• Medium —
  CVE-2010-1618

  phpCAS client library and Moodle Cross-site Scripting vulnerability

  Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly handled i…

  moodle/moodle apereo/phpcas Packagist
  Apr 29, 2010
• Low —
  CVE-2010-1619

  Moodle vulnerable to Cross-site Scripting

  Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTM…

  moodle/moodle Packagist
  Apr 29, 2010
• Unscored —
  CVE-2010-2228

  Cross-site scripting (XSS) vulnerability in the MNET access-control interface in Moodle before 1.8.13 and 1.9.x before …

  Jun 28, 2010
• Unscored —
  CVE-2010-2229

  Multiple cross-site scripting (XSS) vulnerabilities in blog/index.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 al…

  Jun 28, 2010
• Medium —
  CVE-2010-2230

  Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter

  The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.

  moodle/moodle wordpress Debian Packagist
  Jun 28, 2010
• Unscored —
  CVE-2010-2231

  Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.1…

  Jun 28, 2010