CVE-2011-4294

CVE-2011-4294 describes an open redirect flaw in Moodle’s error-message handling. In Moodle 1.9.x (before 1.9.13), 2.0.x (before 2.0.4), and 2.1.x (before 2.1.1), continuation links in error messages are not guaranteed to point to http(s) URLs of the local Moodle instance, enabling attackers to l...

CVE-2011-4295

The moodleenrolexternal:roleassign function in enrol/externallib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not have an authorization check, which allows remote authenticated users to gain privileges by making a role assignment...

CVE-2011-4292

Moodle 2.0.x before 2.0.3 allows remote authenticated users to cause a denial of service invalid database records via a series of crafted comments operations...

CVE-2011-4291

CVE-2011-4291 affects Moodle 2.0.x before 2.0.3. The vulnerability allows remote authenticated users to cause a denial of service by performing a sequence of crafted ratings operations that lead to invalid database records. The available connected documents confirm the affected product/version an...

CVE-2011-4285

The default configuration of Moodle 2.0.x before 2.0.2 has an incorrect setting of the moodle/course:delete capability, which allows remote authenticated users to delete arbitrary courses by leveraging the teacher role...

CVE-2011-4282

Multiple cross-site scripting XSS vulnerabilities in the course-tags functionality in tag/coursetagsmore.php in Moodle 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via the 1 sort or 2 show parameter...

CVE-2011-4278

The vulnerability is an XSS flaw in Moodle’s tag autocomplete feature. Affected products: Moodle 1.9.x before 1.9.11 and Moodle 2.0.x before 2.0.2. Root cause: the tag autocomplete code path allows injection of arbitrary web script or HTML via unspecified vectors. Impact: remote attackers could e...

CVE-2011-4293

The Moodle vulnerability CVE-2011-4293 affects Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1, where the theme implementation dupes caching of CSS and JavaScript content. This duplication can bypass access restrictions and allow writing to the operating system’s temporary directory via unspecif...

CVE-2011-4294

The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via...

CVE-2011-4297

CVE-2011-4297 affects Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1. The flaw in the file comment/lib.php fails to properly restrict comment capabilities, allowing remote attackers to post a comment by leveraging the guest role on a front-page activity. The available connected documents confir...

CVE-2011-4287

admin/uploaduserform.php in Moodle 2.0.x before 2.0.3 does not force password changes for autosubscribed users, which makes it easier for remote attackers to obtain access by leveraging knowledge of the initial password of a new user...

CVE-2011-4280

Cross-site scripting XSS vulnerability in the Spike PHPCoverage aka spikephpcoverage library, as used in Moodle 2.0.x before 2.0.2 and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4290

Multiple cross-site scripting XSS vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to URL encoding...

CVE-2011-4296

lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, which allows remote authenticated users to modify course filters by leveraging this role...

CVE-2011-4278

Cross-site scripting XSS vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4296

CVE-2011-4296 concerns Moodle where lib/db/access.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 assigns incorrect capabilities to the course-creator role, allowing remote authenticated users to modify course filters by leveraging this role. Affected versions: Moodle 2.0.x up to 2.0.3; M...

CVE-2011-4283

The CVE refers to Moodle prior to 1.9.11 and 2.0.x prior to 2.0.2, where an IMS enterprise enrolment file is placed in the course-files area, allowing remote attackers to retrieve imsenterprise-enrol.xml and obtain sensitive information. Concretely, affected software: Moodle 1.9.x up to 1.9.11 an...

CVE-2011-4279

Summary (CVE-2011-4279) : Moodle 2.0.x before 2.0.2 does not apply the forceloginforprofiles setting to course-profiles access control, which can allow remote attackers to access potentially sensitive information via search-engine-enabled vectors (e.g., Google, Yahoo, Yandex). Affected product/ve...

CVE-2011-4297

comment/lib.php in Moodle 2.0.x before 2.0.4 and 2.1.x before 2.1.1 does not properly restrict comment capabilities, which allows remote attackers to post a comment by leveraging the guest role and operating on a front-page activity...

CVE-2011-4284

Concrete details available: CVE-2011-4284 affects Moodle 2.0.x prior to 2.0.2, where the myprofile block can disclose sensitive information when a user-context page is visited. The root cause is exposure via the myprofile block, enabling remote attackers to obtain partial confidential data. Docum...