Skip to content
OpenAdvisories

Archive

22 March 2014

Vulnerabilities first published on this day (UTC), newest first.

← February 2014 2014 / March /22 April 2014 →
  1. 1 
  2. 217
  3. 325
  4. 44
  5. 524
  6. 629
  7. 718
  8. 8 
  9. 9 
  10. 109
  11. 1142
  12. 1230
  13. 135
  14. 1487
  15. 15 
  16. 1633
  17. 17 
  18. 1823
  19. 1930
  20. 2026
  21. 217
  22. 2217
  23. 2310
  24. 249
  25. 2520
  26. 2611
  27. 2720
  28. 2828
  29. 298
  30. 308
  31. 31 
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium —
    CVE-2013-7341

    Moodle cross-site scripting (XSS) vulnerabilities

    Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) provi…

    moodle/moodle moodle typo3/cms Ubuntu Packagist
  • Medium —
    CVE-2014-0122

    Moodle allows bypass of intended access restrictions

    mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access re…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0127

    Moodle's time-validation implementation allows bypassing intended restrictions

    The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to bypass intended restricti…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0124

    Moodle allows attackers to obtain sensitive information

    The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows rem…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0129

    Moodle allows attackers to modify the visibility of a badge

    badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to modify the visibility of an arbitrary badge via unspecified vectors.

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0123

    Moodle does not properly restrict access

    The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows remote authenticated users to perform wiki operations by leveraging the student r…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0125

    Moodle places a session key in a URL

    repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file'…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-0126

    Moodle cross-site request forgery (CSRF) vulnerability

    Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to hijack the authentication of administrators for requests t…

    moodle/moodle Packagist
  • Medium —
    CVE-2014-2572

    Moodle attackers to modify grade metadata

    mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.

    moodle/moodle Packagist