39 results · Clear filters · Feed
-
Low 3.5
Moodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.
A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages after they have successfully authenticated. This occurs due to insufficient validation of redirect param…
-
Low 3.1
Moodle: csrf token exposure via url in moodle mod_data module
A security vulnerability was found in Moodle where confidential information that prevents cross-site request forgery (CSRF) attacks was shared publicly through the site's URL. This vulnerability occurred specifically on two types of pages within the mod_data …
-
Low 3.5
Moodle: csrf risk in moodle user tours manager allows tour duplication
A security vulnerability was discovered in Moodle that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks.
-
Low 3.1
Teachers can evade trusttext config when restoring glossary entries
Additional checks were required to ensure trusttext is applied (when enabled) to glossary entries being restored.
-
Low 3.1
IDOR in badges allows disabling of arbitrary badges
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
-
Low 3.4
Stored XSS in ddimageortext question type
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
-
Low 3.7
Moodle: admin presets export tool includes some secrets that should not be exported
A flaw was found in moodle. When creating an export of site administration presets, some sensitive secrets and keys are not being excluded from the export, which could result in them unintentionally being leaked if the presets are shared with a third party.
-
Low 3.5
moodle: CSRF risk in analytics management of models
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.
-
Low 3.5
Msa-24-0006: idor on dashboard comments block
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).
-
Low 3.3
Moodle: forum summary report shows students from other groups when in separate groups mode
Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.
-
Low 3.3
Moodle: insufficient capability checks when updating the parent of a course category
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.
-
Low 3.3
Moodle: cache poisoning risk with endpoint revision numbers
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
-
Low 3.3
Moodle: xss risk when previewing data in course upload tool
The course upload preview contained an XSS risk for users uploading unsafe data.
-
Low 3.3
Moodle: auto-populated h5p author name causes a potential information leak
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
-
Low 3.3
Moodle: students can view other users in "only see own membership" groups
Students in "Only see own membership" groups could see other students in the group, which should be hidden.
-
Low 3.3
Moodle: xss risk when using csv grade import method
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
-
Low 3.8
Insufficient user authorization in Moodle
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessin…
-
Low 3.7
Moodle Email media URL tokens were not checking for user status
A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the f…
-
Low 3.1
Moodle open redirect vulnerability
A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.
-
Low 3.1
Moodle Open Redirect Vulnerability
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
-
Low —
Moodle does not set the RISK_XSS bit for graders
access.php in the Lesson module in Moodle 2.8.x before 2.8.2 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted essay feedback.
-
Low —
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in course/pending.php in Moodle through 2.5.9, 2.6.x before 2.6.7, 2.7.x before 2.7.4, and 2.8.x before 2.8.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted course summary.
-
Low —
Moodle allows attackers to bypass intended login restrictions
login/confirm.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to bypass intended login restrictions by leveraging access to an unconfirmed suspended account.
-
Low —
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the external_format_text function in lib/externallib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to inject arbitrary web script or H…
-
Low —
Moodle does not set the RISK_XSS bit for graders
mod/quiz/db/access.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 does not set the RISK_XSS bit for graders, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradeb…
-
Low —
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in mod/quiz/report/statistics/statistics_question_table.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HT…
-
Low —CVE-2015-2269 Public exploit
Moodle XSS Vulnerability
Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2…
-
Low —
Moodle allows attackers to upload files containing JavaScript
webservice/upload.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not ensure that a file upload is for a private or draft area, which allows remote authenticated users to upload files containing JavaScript, and consequently conduct cross-site scr…
-
Low —
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by …
-
Low —CVE-2014-3544 Public exploit
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype I…
-
Low —CVE-2014-3551 Public exploit
Moodle multiple cross-site scripting (XSS) vulnerabilities
Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote authenticated users to inject arbitrary web s…
-
Low —
Moodle cross-site scripting (XSS) vulnerability
Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote authenticated users to inject arbitrary web script o…
-
Low —
Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted fi…
-
Low —
Moodle's login_as feature leaks information from external repositories
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
-
Low —
Moodle vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in the course-tags functionality in tag/coursetags_more.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) sort or (2) show parameter.
-
Low —
Moodle vulnerable to Cross-Site Scripting
Cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment.
-
Low —
Moodle vulnerable to Cross-site Scripting
Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is ena…
-
Low —
Moodle vulnerable to Cross-site Scripting
Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTM…
-
Low —
Moodle doesn't properly check role
user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.