8583 matches found
CVE-2011-4286
CVE-2011-4286 affects Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2, where the media-filter implementation (filter/mediaplugin/filter.php) is vulnerable to multiple cross-site scripting (XSS) via (1) Flash Video files and (2) YouTube videos. The root cause is improper handling of input in the...
CVE-2011-4281
Multiple cross-site request forgery CSRF vulnerabilities in Moodle 2.0.x before 2.0.2 allow remote attackers to hijack the authentication of arbitrary users for requests that mark the completion of 1 an activity or 2 a course...
CVE-2011-4133
Cross-site request forgery CSRF vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block...
CVE-2011-4286
Multiple cross-site scripting XSS vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving 1 Flash Video aka FLV files and 2 YouTube...
CVE-2011-4285
The vulnerability CVE-2011-4285 affects Moodle 2.0.x before 2.0.2. The default configuration incorrectly grants the moodle/course:delete capability, enabling remote authenticated users (via the teacher role) to delete arbitrary courses. The connected sources confirm the root cause is the misconfi...
CVE-2011-4282
CVE-2011-4282 concerns Moodle 2.0.x prior to 2.0.2. The vulnerability is in the course-tags feature (tag/coursetags_more.php) where the parameters (1) sort and (2) show can be exploited to inject arbitrary web script or HTML, constituting cross-site scripting (XSS). The affected component is Mood...
CVE-2011-4292
Summary (CVE-2011-4292) : Moodle 2.0.x prior to 2.0.3 is affected. Remote authenticated users can trigger a denial of service by performing a sequence of crafted comments operations, leading to invalid database records. The vulnerability impact is limited to DoS; no exploitation details are provi...
CVE-2011-4288
The CVE-2011-4288 issue affects Moodle 1.9.x up to 1.9.11 and 2.0.x up to 2.0.2, due to improper associations between teachers and groups. This allows remote authenticated users with the teacher role to read quiz reports of arbitrary students. Root cause: flawed access control for teacher-group a...
CVE-2011-4133
CVE-2011-4133 is a CSRF vulnerability affecting Moodle 1.9.x prior to 1.9.11. The issue allows an attacker to hijack the authentication of unspecified victims to perform requests that modify an RSS feed in an RSS block. The primary impact is authenticated user session abuse for modifying RSS cont...
CVE-2011-4293
The theme implementation in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 triggers duplicate caching of Cascading Style Sheets CSS and JavaScript content, which allows remote attackers to bypass intended access restrictions and write to an operating-system temporary directory via unspecified...
CVE-2011-4290
CVE-2011-4290 involves Moodle 1.9.x before 1.9.12. The vulnerability is in the file lib/weblib.php (Moodle’s web library) and results from issues with URL encoding that enable multiple cross-site scripting (XSS) flaws. Exploitation allows remote attackers to inject arbitrary script/HTML. The docu...
CVE-2011-4284
Moodle 2.0.x before 2.0.2 allows remote attackers to obtain sensitive information from a myprofile aka My profile block by visiting a user-context page...
CVE-2011-4281
CVE-2011-4281 concerns Moodle 2.0.x before 2.0.2, where multiple CSRF flaws allow remote attackers to hijack a user’s session to mark completion of (1) an activity or (2) a course. The connected documents consistently describe the CSRF vector and impact but do not provide concrete patch versions ...
CVE-2011-4287
CVE-2011-4287 affects Moodle 2.0.x before 2.0.3 where admin/uploaduser_form.php does not force password changes for autosubscribed users. This allows remote attackers to gain access by using the initial password of a newly created autosubscribed account. The issue is documented across multiple so...
CVE-2011-4289
CVE-2011-4289 – Moodle 2.0.x before 2.0.3 : The vulnerability arises because Moodle does not recognize the configuration that restricts email addresses to course members. As a result, remote authenticated users can read full profile pages and obtain sensitive address information. The description ...
CVE-2011-4295
CVE-2011-4295 affects Moodle’s enrolment external API: the function moodle_enrol_external:role_assign in enrol/externallib.php lacks an authorization check in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1, allowing remote authenticated users to escalate privileges by assigning roles. The issue...
CVE-2011-4289
Moodle 2.0.x before 2.0.3 does not recognize the configuration setting that makes e-mail addresses visible only to course members, which allows remote authenticated users to obtain sensitive address information by reading a full profile page...
CVE-2011-4288
Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role...
CVE-2011-4279
Moodle 2.0.x before 2.0.2 does not use the forceloginforprofiles setting for course-profiles access control, which makes it easier for remote attackers to obtain potentially sensitive information via vectors involving use of a search engine, as demonstrated by the search functionality of Google,...