CVE-2011-4278

Cross-site scripting XSS vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4281

Multiple cross-site request forgery CSRF vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of 1 an activity or 2 a course...

CVE-2011-4283

Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml...

CVE-2011-4281

Multiple cross-site request forgery CSRF vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of 1 an activity or 2 a course...

CVE-2011-4282

CVE-2011-4282 concerns Moodle 2.0.x prior to 2.0.2. The vulnerability is in the course-tags feature (tag/coursetags_more.php) where the parameters (1) sort and (2) show can be exploited to inject arbitrary web script or HTML, constituting cross-site scripting (XSS). The affected component is Mood...

CVE-2011-4280

The CVE-2011-4280 entry describes an XSS vulnerability in the Spike PHPCoverage (aka spikephpcoverage) library as used in Moodle 2.0.x before 2.0.2 and other products. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, indicating a client-side/script...

CVE-2011-4286

CVE-2011-4286 affects Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2, where the media-filter implementation (filter/mediaplugin/filter.php) is vulnerable to multiple cross-site scripting (XSS) via (1) Flash Video files and (2) YouTube videos. The root cause is improper handling of input in the...

CVE-2011-4288

The CVE-2011-4288 issue affects Moodle 1.9.x up to 1.9.11 and 2.0.x up to 2.0.2, due to improper associations between teachers and groups. This allows remote authenticated users with the teacher role to read quiz reports of arbitrary students. Root cause: flawed access control for teacher-group a...

CVE-2011-4292

Summary (CVE-2011-4292) : Moodle 2.0.x prior to 2.0.3 is affected. Remote authenticated users can trigger a denial of service by performing a sequence of crafted comments operations, leading to invalid database records. The vulnerability impact is limited to DoS; no exploitation details are provi...

CVE-2011-4285

The vulnerability CVE-2011-4285 affects Moodle 2.0.x before 2.0.2. The default configuration incorrectly grants the moodle/course:delete capability, enabling remote authenticated users (via the teacher role) to delete arbitrary courses. The connected sources confirm the root cause is the misconfi...

CVE-2011-4133

Cross-site request forgery CSRF vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block...

CVE-2011-4133

CVE-2011-4133 is a CSRF vulnerability affecting Moodle 1.9.x prior to 1.9.11. The issue allows an attacker to hijack the authentication of unspecified victims to perform requests that modify an RSS feed in an RSS block. The primary impact is authenticated user session abuse for modifying RSS cont...

CVE-2011-4287

CVE-2011-4287 affects Moodle 2.0.x before 2.0.3 where admin/uploaduser_form.php does not force password changes for autosubscribed users. This allows remote attackers to gain access by using the initial password of a newly created autosubscribed account. The issue is documented across multiple so...

CVE-2011-4281

CVE-2011-4281 concerns Moodle 2.0.x before 2.0.2, where multiple CSRF flaws allow remote attackers to hijack a user’s session to mark completion of (1) an activity or (2) a course. The connected documents consistently describe the CSRF vector and impact but do not provide concrete patch versions ...

CVE-2011-4291

CVE-2011-4291 affects Moodle 2.0.x before 2.0.3. The vulnerability allows remote authenticated users to cause a denial of service by performing a sequence of crafted ratings operations that lead to invalid database records. The available connected documents confirm the affected product/version an...

CVE-2011-4295

The moodleenrolexternal:roleassign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment...

CVE-2011-4290

CVE-2011-4290 involves Moodle 1.9.x before 1.9.12. The vulnerability is in the file lib/weblib.php (Moodle’s web library) and results from issues with URL encoding that enable multiple cross-site scripting (XSS) flaws. Exploitation allows remote attackers to inject arbitrary script/HTML. The docu...

CVE-2011-4289

CVE-2011-4289 – Moodle 2.0.x before 2.0.3 : The vulnerability arises because Moodle does not recognize the configuration that restricts email addresses to course members. As a result, remote authenticated users can read full profile pages and obtain sensitive address information. The description ...

CVE-2011-4295

CVE-2011-4295 affects Moodle’s enrolment external API: the function moodle_enrol_external:role_assign in enrol/externallib.php lacks an authorization check in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1, allowing remote authenticated users to escalate privileges by assigning roles. The issue...

CVE-2011-4294

CVE-2011-4294 describes an open redirect flaw in Moodle’s error-message handling. In Moodle 1.9.x (before 1.9.13), 2.0.x (before 2.0.4), and 2.1.x (before 2.1.1), continuation links in error messages are not guaranteed to point to http(s) URLs of the local Moodle instance, enabling attackers to l...