CVE-2011-4298

The CVE refers to multiple CSRF vulnerabilities in Moodle’s mod/wiki components affecting Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2, allowing remote attackers to hijack authentication for wiki data modification. The root cause is cross-site request forgery within the wiki module. Affected ...

CVE-2011-4301

The CVE-2011-4301 issue affects Moodle’s Forms Library (MoodleQuickForm in lib/formslib.php) where the Forms API setConstant operation is not recognized. This allows remote attackers to submit unexpected form content by modifying constant field values. Affected versions are Moodle 1.9.x prior to ...

CVE-2011-4303

lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registrationhubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature...

CVE-2011-4307

Cross-site scripting XSS vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter...

CVE-2011-4309

Affected software: Moodle 2.0.x (before 2.0.5) and 2.1.x (before 2.1.2). Root cause: vulnerability in access restrictions allowing remote attackers to bypass restrictions and perform global searches by using the guest role and issuing a direct URL request. Impact: allows bypass of intended access...

CVE-2011-4301

The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant...

CVE-2011-4302

Moodle vulnerability CVE-2011-4302 affects MNET in Moodle: 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2. The issue is improper processing of the return value from openssl_verify in mnet/xmlrpc/client.php, allowing remote attackers to bypass certificate validation with a crafted...

CVE-2011-4306

Moodle 1.9.x before 1.9.14 is affected by a Cross-site Scripting (XSS) vulnerability in course/editsection.html that allows remote authenticated users to inject arbitrary script/HTML via crafted data. Root cause: insufficient input sanitization in that page. Impact: potential defacement, social e...

CVE-2011-4304

The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation...

CVE-2011-4308

The CVE concerns Moodle’s mod/forum/user.php, where remote authenticated users could disclose other users’ names. Affected are Moodle 1.9.x < 1.9.14, 2.0.x < 2.0.5, and 2.1.x

CVE-2011-4308

mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors...

CVE-2011-4300

The CVE-2011-4300 issue affects Moodle’s file_browser in versions 2.0.0–2.0.4 and 2.1.0–2.1.1. It fails to properly restrict access to category and course data, enabling remote attackers to obtain potentially sensitive information by requesting a file. The documented remediation is to upgrade to ...

CVE-2011-4304

CVE-2011-4304 affects Moodle chat functionality (versions 2.0.x prior to 2.0.5 and 2.1.x prior to 2.1.2). The cited issue enables remote authenticated users to discover the name of another user via a beep operation. The PT-2012-1852 entry confirms affected versions and provides remediation guidan...

CVE-2011-4299

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 contain a cross-site scripting (XSS) vulnerability in mod/wiki/pagelib.php that allows remote authenticated users to inject arbitrary script or HTML via a wiki comment. Root cause: improper sanitization in the wiki page rendering path. Affected sof...

CVE-2011-4306

Cross-site scripting XSS vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data...

CVE-2011-4299

Cross-site scripting XSS vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment...

CVE-2011-4305

message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service infinite request loop via a URL that specifies a zero wait time for message refreshing...

CVE-2011-4302

mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the opensslverify function, which allows remote attackers to bypass validation via a crafted certificate...

CVE-2011-4298

Multiple cross-site request forgery CSRF vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data...

CVE-2011-4307

Affected software: Moodle, specifically the wiki module file /mod/wiki/lang/en/wiki.php. Vulnerability: Cross-site scripting (XSS) via the section parameter. Root cause / impact: Input in the section parameter can be injected as arbitrary script/HTML, enabling remote code-like content execution i...