CVE-2012-2367

The CVE affects Moodle versions: 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3. A remote authenticated user can bypass the moodle/calendar:manageownentries capability and create a calendar entry via New Entry. Root cause is a capability check bypass in the ca...

CVE-2012-2363

SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands via a crafted calendar event...

CVE-2012-2361

CVE-2012-2361 is an XSS vulnerability in Moodle’s web services: remote authenticated users can inject arbitrary script/HTML via the name field in admin/webservice/forms.php to admin/webservice/service.php. Affected versions are Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3...

CVE-2012-2364

Cross-site scripting XSS vulnerability in lib/filelib.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via an assignment submission with zip compression, leading to text/html rendering during a...

CVE-2012-2354

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/site:readallmessages capability requirement and read arbitrary messages by using the "Recent conversations" feature with a modified parameter in a URL...

CVE-2012-2353

Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to obtain sensitive user information from hidden fields by leveraging the teacher role and navigating to "Enrolled users" under the Users Settings section...

CVE-2012-2365

Cross-site scripting XSS vulnerability in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via the idnumber field to cohort/edit.php...

CVE-2012-2365

CVE-2012-2365 is a cross-site scripting (XSS) vulnerability in Moodle affecting cohort/edit.php, triggered by the idnumber field. Affected products/versions include Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3, with the issue exploitable by remote authenticated users. The...

CVE-2012-2364

CVE-2012-2364 describes an XSS vulnerability in Moodle’s lib/filelib.php that affects Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3. Remote authenticated users can inject arbitrary script/HTML via an assignment submission with ZIP compression, leading to text/html renderin...

CVE-2012-2360

Cross-site scripting XSS vulnerability in the Wiki subsystem in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted string that is inserted into a page title...

CVE-2012-2366

CVE-2012-2366 affects Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3. The issue is in mod/data/preset.php, where improper iteration over an array allows remote authenticated users to overwrite arbitrary database activity presets via unspecified vectors. Root cause: faulty array handling leads t...

CVE-2012-2353

CVE-2012-2353 affects Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3. The issue allows remote authenticated users with the teacher role to obtain sensitive user information from hidden fields by navigating to the Enrolled users page under Users Settings. The description states the vulnerability...

CVE-2012-2362

Moodle 1.9.x is affected by CVE-2012-2362: an XSS in blog/lib.php is exploitable via a crafted parameter to blog/index.php when using Internet Explorer, affecting versions before 1.9.18. The issue allows remote injection of arbitrary script/HTML. Connected sources confirm the vulnerability detail...

CVE-2012-2357

CVE-2012-2357 affects Moodle 2.1.x (before 2.1.6) and 2.2.x (before 2.2.3). The issue is in the Multi-Authentication CAS feature (auth/cas/cas_form.html) that does not use HTTPS, enabling credential sniffing over the network by remote attackers. The root cause is unauthenticated, unencrypted tran...

CVE-2012-2356

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...

CVE-2012-2359

CVE-2012-2359 affects Moodle versions 2.0.x < 2.0.9, 2.1.x < 2.1.6, and 2.2.x

CVE-2012-2357

The Multi-Authentication feature in the Central Authentication Service CAS functionality in auth/cas/casform.html in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not use HTTPS, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2012-2366

mod/data/preset.php in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not properly iterate through an array, which allows remote authenticated users to overwrite arbitrary database activity presets via unspecified vectors...

CVE-2012-2359

admin/roles/override.php in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to gain privileges by leveraging the teacher role and modifying their own capabilities, as demonstrated by obtaining the backup:userinfo capability...

CVE-2012-2354

Vulnerability summary (CVE-2012-2354): Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allow remote authenticated users to bypass the moodle/site:readallmessages capability and read arbitrary messages by tampering the URL parameter in the Recent conversations feature. The issue affects Moodle in...