Code injection

webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote authenticated users to run arbitrary external-service functions via a token intended for only one service...

Security feature bypass

Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities...

Design/Logic Flaw

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response...

CVE-2012-4408

CVE-2012-4408 affects Moodle: 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2. The issue arises because course/reset.php validates an update capability instead of a reset capability, allowing remote authenticated users to bypass intended access restrictions via a reset operation. I...

CVE-2012-4402

The CVE relates to Moodle (2.1.x before 2.1.8, 2.2.x before 2.2.5, 2.3.x before 2.3.2). The issue is that web-service tokens are not properly restricted, allowing remote authenticated users to invoke functions from external services using a token intended for a single service. Impact per sources ...

CVE-2012-4403

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response...

CVE-2012-4400

Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 are affected by CVE-2012-4400 due to a flaw in repository/repository_ajax.php that allows remote authenticated users to bypass upload-size restrictions by sending -1 in the maxbytes field. The underlying issue is insufficient input validation for t...

CVE-2012-4401

Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging course-editing capabilities...

CVE-2012-4400

repository/repositoryajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in the maxbytes field...

CVE-2012-4402

webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote authenticated users to run arbitrary external-service functions via a token intended for only one service...

CVE-2012-4408

course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote authenticated users to bypass intended access restrictions via a reset operation...

CVE-2012-4407

CVE-2012-4407 affects Moodle: information disclosure in lib/filelib.php where Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files. This allows remote attackers to read a blog entry that references a non-public file and ...

CVE-2012-4401

Summary: CVE-2012-4401 affects Moodle core (Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2). The issue lets remote authenticated users bypass intended capability restrictions and modify topics by exploiting course-editing capabilities. What’s affected: Moodle course editing functionality; speci...

CVE-2012-4407

lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers to obtain sensitive information by reading a blog entry that references a non-public file...

CVE-2012-4403

Moodle 2.3.x before 2.3.2 is affected by CVE-2012-4403 due to improper construction of error responses in theme/yui_combo.php for the drag‑and‑drop script. This allows an unauthenticated remote attacker to discover the installation path by requesting a nonexistent resource and reading the respons...

NGS00208 Patch Notification: Moodle CMS stored XSS

High risk vulnerability in Moodle CMS 20 August 2012 Daniel Compton of NCC Group has discovered a High risk vulnerability in Moodle CMS Impact: Stored XSS Versions affected: Moodle v2.2.1 An updated version of the software has been released to address these vulnerabilities:...

Fedora Update for moodle FEDORA-2012-8284

Check for the Version of moodle OpenVAS Vulnerability Test Fedora Update for moodle FEDORA-2012-8284 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Fedora Update for moodle FEDORA-2012-7655

Check for the Version of moodle OpenVAS Vulnerability Test Fedora Update for moodle FEDORA-2012-7655 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Fedora Update for moodle FEDORA-2012-5286

Check for the Version of moodle OpenVAS Vulnerability Test Fedora Update for moodle FEDORA-2012-5286 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

Fedora Update for moodle FEDORA-2012-7655

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...