Design/Logic Flaw

lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable...

Design/Logic Flaw

Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/actionredir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface...

Authorization

Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with 1 disabled services and 2 users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens...

CVE-2011-4589

backup/moodle2/restorestepslib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not check for the moodle/course:changeidnumber privilege during handling of course ID numbers, which allows remote authenticated users to overwrite ID numbers via a restore action...

CVE-2011-4585

login/changepassword.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2011-4581

CVE-2011-4581 affects Moodle: mod/wiki/pagelib.php in Moodle 2.0.x (before 2.0.6) and 2.1.x (before 2.1.3) allows remote authenticated users to discover the username of a wiki creator via the history and deletion user interface. The underlying issue is exposure of creator usernames through wiki h...

CVE-2011-4592

The command-line cron implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly interact with IP blocking, which might allow remote attackers to bypass intended IP address restrictions by leveraging a configuration in which IP blocking was disabled to restore cron...

CVE-2011-4583

Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with 1 disabled services and 2 users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens...

CVE-2011-4581

mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 allows remote authenticated users to discover the username of a wiki creator by visiting the history and deletion user interface...

CVE-2011-4591

CVE-2011-4591 affects Moodle: a Cross-site Scripting (XSS) flaw in the print_object function (lib/datalib.php) present in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3, triggered when a developer debugging script is enabled. The issue allows remote attackers to inject arbitrary web script/HTML...

CVE-2011-4593

CVE-2011-4593 affects Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3, where the messaging interface incorrectly handles user/action_redir group messages, allowing remote authenticated users to discover e-mail addresses by visiting the messaging interface. Root cause: impro...

CVE-2011-4587

CVE-2011-4587 affects Moodle: the advisory describes a vulnerability in lib/moodlelib.php where certain zero values in the password policy are not handled correctly, enabling remote attackers to gain access by leveraging the existence of user accounts with blank passwords. Affected versions are M...

CVE-2011-4585

CVE-2011-4585 affects Moodle 1.9.x before 1.9.15. The login/change_password.php form does not use HTTPS even when the httpslogin option is enabled, enabling credential sniffing over the network. Debian/OpenVAS references document this as part of a set of Moodle vulnerabilities; Debian’s advisory ...

CVE-2011-4584

The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Maha...

CVE-2011-4589

The CVE-2011-4589 entry affects Moodle 2.0.x prior to 2.0.6 and Moodle 2.1.x prior to 2.1.3. The vulnerability arises in backup/moodle2/restore_stepslib.php where it does not verify the moodle/course:changeidnumber privilege while handling of course ID numbers, enabling remote authenticated users...

CVE-2011-4590

The web services implementation in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 does not properly consider the maintenance-mode state and account attributes during login attempts, which allows remote authenticated users to bypass intended access restrictions by connecting to a webservice serv...

CVE-2011-4585

login/changepassword.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network...

CVE-2011-4587

lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable...

CVE-2011-4590

CVE-2011-4590 affects Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3. The web services login path fails to properly consider maintenance-mode state and account attributes, allowing remote authenticated users to bypass access restrictions by connecting to a webservice server. Impact per the entr...

CVE-2011-4588

The ipinrange function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request...