CVE-2011-4300

The filebrowser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file...

CVE-2011-4298

Multiple cross-site request forgery CSRF vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data...

CVE-2011-4302

mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the opensslverify function, which allows remote attackers to bypass validation via a crafted certificate...

CVE-2011-4299

Cross-site scripting XSS vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment...

CVE-2011-4309

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL...

CVE-2011-4307

Cross-site scripting XSS vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter...

CVE-2011-4298

The CVE refers to multiple CSRF vulnerabilities in Moodle’s mod/wiki components affecting Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2, allowing remote attackers to hijack authentication for wiki data modification. The root cause is cross-site request forgery within the wiki module. Affected ...

CVE-2011-4305

Affected software: Moodle 1.9.x (up to 1.9.13). Vulnerable component: message/refresh.php. Root cause: processing a refresh URL with zero wait time can trigger an infinite request loop, enabling a denial of service by remote authenticated users. Impact: denial of service with partial availability...

CVE-2011-4309

Affected software: Moodle 2.0.x (before 2.0.5) and 2.1.x (before 2.1.2). Root cause: vulnerability in access restrictions allowing remote attackers to bypass restrictions and perform global searches by using the guest role and issuing a direct URL request. Impact: allows bypass of intended access...

CVE-2011-4301

The CVE-2011-4301 issue affects Moodle’s Forms Library (MoodleQuickForm in lib/formslib.php) where the Forms API setConstant operation is not recognized. This allows remote attackers to submit unexpected form content by modifying constant field values. Affected versions are Moodle 1.9.x prior to ...

CVE-2011-4304

CVE-2011-4304 affects Moodle chat functionality (versions 2.0.x prior to 2.0.5 and 2.1.x prior to 2.1.2). The cited issue enables remote authenticated users to discover the name of another user via a beep operation. The PT-2012-1852 entry confirms affected versions and provides remediation guidan...

CVE-2011-4308

mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors...

CVE-2011-4300

The CVE-2011-4300 issue affects Moodle’s file_browser in versions 2.0.0–2.0.4 and 2.1.0–2.1.1. It fails to properly restrict access to category and course data, enabling remote attackers to obtain potentially sensitive information by requesting a file. The documented remediation is to upgrade to ...

CVE-2011-4299

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 contain a cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php that allows remote authenticated users to inject arbitrary script or HTML via a wiki comment. Root cause: improper sanitization in the wiki page rendering path. Affected sof...

CVE-2011-4308

The CVE concerns Moodle’s mod/forum/user.php, where remote authenticated users could disclose other users’ names. Affected are Moodle 1.9.x < 1.9.14, 2.0.x < 2.0.5, and 2.1.x

CVE-2011-4302

Moodle vulnerability CVE-2011-4302 affects MNET in Moodle: 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2. The issue is improper processing of the return value from openssl_verify in mnet/xmlrpc/client.php, allowing remote attackers to bypass certificate validation with a crafted...

CVE-2011-4306

Moodle 1.9.x before 1.9.14 is affected by a Cross-site Scripting (XSS) vulnerability in course/editsection.html that allows remote authenticated users to inject arbitrary script/HTML via crafted data. Root cause: insufficient input sanitization in that page. Impact: potential defacement, social e...

CVE-2011-4307

Affected software: Moodle, specifically the wiki module file /mod/wiki/lang/en/wiki.php. Vulnerability: Cross-site scripting (XSS) via the section parameter. Root cause / impact: Input in the section parameter can be injected as arbitrary script/HTML, enabling remote code-like content execution i...

CVE-2011-4306

Cross-site scripting XSS vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data...

CVE-2011-4303

CVE-2011-4303 affects Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2. The root cause is an incorrect registration_hubs.secret value set during installation, which allows remote attackers to bypass access restrictions via the hubs feature. Documents specify the affected versions and the fix: upg...