CVE-2012-3398

Algorithmic complexity vulnerability in Moodle 1.9.x before 1.9.19, 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to cause a denial of service CPU consumption by using the advanced-search feature on a database activity that has many records...

CVE-2012-3387

Moodle 2.3.x before 2.3.1 is affected. The root cause is a client-side check only for permitted references during file uploads, allowing remote authenticated users to bypass alias/shortcut restrictions if the client omits this check. The issue is mitigated by upgrading to Moodle 2.3.1 (or applyin...

CVE-2012-3393

CVE-2012-3393 is an XSS vulnerability in Moodle via repository/lib.php, exploitable by remote authenticated administrators who rename a repository. Affected versions are Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4. The underlying flaw allows injection of arbitrary web script/HTML by tamperin...

CVE-2012-3391

mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a...

CVE-2012-3395

SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute arbitrary SQL commands via crafted form data...

CVE-2012-3396

CVE-2012-3396 is a cross-site scripting (XSS) vulnerability in Moodle’s cohort/edit_form.php that affects Moodle 2.0.x < 2.0.10, 2.1.x < 2.1.7, 2.2.x < 2.2.4, and 2.3.x

CVE-2012-3389

Multiple cross-site scripting XSS vulnerabilities in mod/lti/typessettings.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the 1 ltitypename or 2 ltitoolurl parameter...

CVE-2012-3397

lib/modinfolib.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 does not check for a group-membership requirement when determining whether an activity is unavailable or hidden, which allows remote authenticated users to bypass intended access...

CVE-2012-3389

Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 are affected by multiple XSS vulnerabilities in mod/lti/typessettings.php, allowing remote attackers to inject arbitrary JavaScript/HTML via lti_typename or lti_toolurl. Root cause: un-sanitized input in the LTI settings path. Impact: potential ses...

CVE-2012-3391

CVE-2012-3391 affects Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4. The issue in mod/forum/rsslib.php arises from not enforcing the posting-before-reading requirement for Q&A forums, enabling remote authenticated users (student role) to bypass access restrictions by reading the RSS feed. The ...

CVE-2012-3395

CVE-2012-3395 describes an SQL injection in Moodle's mod/feedback/complete.php that lets a remote authenticated user execute arbitrary SQL via crafted form data. Affected are Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4. The vulnerability stems from unsanitized input in ...

CVE-2012-3387

Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias aka shortcut restrictions via a client that omits this check...

CVE-2012-3396

Cross-site scripting XSS vulnerability in cohort/editform.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the idnumber field. NOTE: this vulnerability exists...

CVE-2012-3390

CVE-2012-3390 affects Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4. The issue is that lib/filelib.php does not properly restrict file access after a block has been hidden, allowing remote authenticated users to read a file embedded in a block and obtain sensitive information. The description ...

PT-2012-4683 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.1.x through 2.1.6 Moodle versions 2.2.x through 2.2.3 Description: The issue allows remote authenticated users to obtain sensitive information by reading a file that is embedded in a block, due to improper restriction of fil...

PT-2012-4687 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.9 Moodle versions 2.1.x through 2.1.6 Moodle versions 2.2.x through 2.2.3 Moodle versions 2.3.x through 2.3.0 Description: The issue allows remote attackers to obtain sensitive information by sniffing the...

CVE-2012-2361

Cross-site scripting XSS vulnerability in admin/webservice/forms.php in the web services implementation in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the name field aka the service name to...

CVE-2012-2362

Cross-site scripting XSS vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php...

CVE-2012-2359

admin/roles/override.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to gain privileges by leveraging the teacher role and modifying their own capabilities, as demonstrated by obtaining the backup:userinfo capability...

CVE-2012-2360

Cross-site scripting XSS vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title...