2200 matches found
Information Disclosure
Moodle is vulnerable to information disclosure. The moodle/course:viewhiddencourses capability is not taken into account before listing hidden courses to authenticated users. Using this flaw, authenticated attackers can find names and summary information about courses...
Capability Bypass
Moodle is vulnerable to capability bypass. Authenticated attackers can bypass the mod/lti:view capability because it is only checked at a course level rather than the activity level...
Cross-site Scripting (XSS)
Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script through the course summary field on the course request pending approval page...
Information Disclosure
Moodle is vulnerable to information disclosure. The library functions coreenrolgetcourseenrolmentmethods and enrolselfgetinstanceinfo don't check course visibility permissions, allowing a malicious user to access hidden courses...
Information Disclosure
Moodle is vulnerable to information disclosure. The library allows a guest user to enumerate through sensitive course category details even when force login is enabled...
Information Disclosure
Moodle is vulnerable to information disclosure. Authenticated attackers can use the coreenrolgetenrolledusers web service to obtain sensitive information about course-participants...
Course Name Disclosure
Moodle is vulnerable to course name disclosure. Authenticated attackers can leverage a flaw in admin/tool/monitor/lib.php to find hidden course names by subscribing to rules. These attacks are possible because moodle ignores the moodle/course:viewhiddencourses capability...
Cross-Site Scripting (XSS)
Moodle is vulnerable to cross-site scripting XSS attacks. The attacks are possible because searchpagination function in course/classes/managementrenderer.php does not sanitized the search string in course management interface...
Sensitive Course Structure Information Disclosure
Moodle is vulnerable to sensitive course information disclosure. The disclosure is possible because users with suspended enrollments are not limited from viewing the course structure in the navigation tree...
Unauthorized Calendar Modification
Moodle is vulnerable to unauthorized calendar modification. The application does not check for capabilities for editing the calendar, allowing a malicious user to delete course level calendar subscription created by teacher users...
Moodle Unauthorized Modification Vulnerability
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in Moodle version 3.x. The vulnerability stems from th...
Moodle Information Disclosure Vulnerability (CNVD-2017-24413)
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment, developed by Dr. Martin Dougiamas of Australia. A security vulnerability exists in the Course overview block of Moodle version 3.3. An...
CVE-2017-7532
In Moodle 3.x, course creators are able to change system default settings for courses...
UBUNTU-CVE-2017-7532
In Moodle 3.x, course creators are able to change system default settings for courses...
UBUNTU-CVE-2017-7531
In Moodle 3.3, the course overview block reveals activities in hidden courses...
Default configuration
In Moodle 3.x, course creators are able to change system default settings for courses...
CVE-2017-7532
In Moodle 3.x, course creators are able to change system default settings for courses...
CVE-2017-7531
In Moodle 3.3, the course overview block reveals activities in hidden courses...