CVE-2011-3149

The vulnerability CVE-2011-3149 affects the pam_env module of Linux-PAM (pam) up to version before 1.1.5. The root cause is improper handling of environment variable expansion, which can overflow and allow a local attacker to cause a denial of service via CPU consumption. Affected component is pa...

CVE-2011-4591

Cross-site scripting XSS vulnerability in the printobject function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, when a developer debugging script is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors involving object states...

CVE-2011-4589

backup/moodle2/restorestepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action...

CVE-2011-4587

lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable...

CVE-2011-4591

Cross-site scripting XSS vulnerability in the printobject function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, when a developer debugging script is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors involving object states...

CVE-2011-4587

lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable...

CVE-2011-4581

mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wiki creator by visiting the history and deletion user interface...

CVE-2011-4587

CVE-2011-4587 affects Moodle: the advisory describes a vulnerability in lib/moodlelib.php where certain zero values in the password policy are not handled correctly, enabling remote attackers to gain access by leveraging the existence of user accounts with blank passwords. Affected versions are M...

CVE-2011-4585

CVE-2011-4585 affects Moodle 1.9.x before 1.9.15. The login/change_password.php form does not use HTTPS even when the httpslogin option is enabled, enabling credential sniffing over the network. Debian/OpenVAS references document this as part of a set of Moodle vulnerabilities; Debian’s advisory ...

CVE-2011-4591

CVE-2011-4591 affects Moodle: a Cross-site Scripting (XSS) flaw in the print_object function (lib/datalib.php) present in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, triggered when a developer debugging script is enabled. The issue allows remote attackers to inject arbitrary web script/HTML...

CVE-2011-4592

The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to restore cron...

CVE-2011-4593

CVE-2011-4593 affects Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3, where the messaging interface incorrectly handles user/action_redir group messages, allowing remote authenticated users to discover e-mail addresses by visiting the messaging interface. Root cause: impro...

CVE-2011-4589

The CVE-2011-4589 entry affects Moodle 2.0.x prior to 2.0.6 and Moodle 2.1.x prior to 2.1.3. The vulnerability arises in backup/moodle2/restore_stepslib.php where it does not verify the moodle/course:changeidnumber privilege while handling of course ID numbers, enabling remote authenticated users...

CVE-2011-4581

CVE-2011-4581 affects Moodle: mod/wiki/pagelib.php in Moodle 2.0.x (before 2.0.6) and 2.1.x (before 2.1.3) allows remote authenticated users to discover the username of a wiki creator via the history and deletion user interface. The underlying issue is exposure of creator usernames through wiki h...

CVE-2011-4584

CVE-2011-4584 affects Moodle: MNET authentication in Moodle 1.9.x prior to 1.9.15, 2.0.x prior to 2.0.6, and 2.1.x prior to 2.1.3 permits remote authenticated users to impersonate other accounts via the Login As feature when combined with remote MNET SSO (demonstrated by a Mahara site). Debian/Op...

CVE-2011-4590

CVE-2011-4590 affects Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3. The web services login path fails to properly consider maintenance-mode state and account attributes, allowing remote authenticated users to bypass access restrictions by connecting to a webservice server. Impact per the entr...

CVE-2011-4589

backup/moodle2/restorestepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action...

CVE-2011-4583

Summary: CVE-2011-4583 affects Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, where web service tokens for disabled services and users no longer authorized can be read by remote authenticated users. Affected software: Moodle 2.0.x (pre-2.0.6) and Moodle 2.1.x (pre-2.1.3). Root cause (from avai...

CVE-2011-4586

CRLF injection vulnerability (HTTP header injection/response splitting) in Moodle Calendar subsystem via calendar/set.php affects Moodle 1.9.x <1.9.15, 2.0.x <2.0.6, and 2.1.x

CVE-2011-4592

The CVE-2011-4592 issue affects Moodle’s command-line cron on Moodle 2.0.x (before 2.0.6) and 2.1.x (before 2.1.3). The root cause is improper interaction with IP blocking, which could allow remote attackers to bypass IP restrictions by exploiting a configuration where IP blocking was disabled to...