PT-2012-1848 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.0 through 2.0.4 Moodle versions 2.1.0 through 2.1.1 Description: The file browser component does not properly restrict access to category and course data, allowing remote attackers to obtain potentially sensitive informati...

PT-2012-1854 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.13 Description: A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via crafted data in the course/editsection.html page. This could potentially lead to...

PT-2012-1849 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.13 Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description: The issue allows remote attackers to submit unexpected form content by modifying the values of constant fields. This is...

PT-2012-1847

Name of the Vulnerable Software and Affected Versions Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment. Recommendations For Moodle versio...

CVE-2011-4299: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mod/wiki/pagelib.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to inject arbitrary web script or HTML via a wiki comment...

CVE-2011-4302: Improper Input Validation

mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the opensslverify function, which allows remote attackers to bypass validation via a crafted certificate...

CVE-2011-4309: Undefined Security Weakness

Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to bypass intended access restrictions and perform global searches by leveraging the guest role and making a direct request to a URL...

CVE-2011-4300: Undefined Security Weakness

The filebrowser component in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not properly restrict access to category and course data, which allows remote attackers to obtain potentially sensitive information via a request for a file...

PT-2012-1857 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description: The issue allows remote attackers to bypass intended access restrictions and perform global searches. This is achieved by leveraging the guest role and makin...

CVE-2011-4303: Undefined Security Weakness

lib/db/upgrade.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 does not set the correct registrationhubs.secret value during installation, which allows remote attackers to bypass intended access restrictions by leveraging the hubs feature...

CVE-2011-4307: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mod/wiki/lang/en/wiki.php in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote attackers to inject arbitrary web script or HTML via the section parameter...

CVE-2011-4304: Exposure of Sensitive Information to an Unauthorized Actor

The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation...

CVE-2011-4301: Undefined Security Weakness

The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant...

PT-2012-1850 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.13 Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description: The issue arises from improper processing of the return value of the openssl verify function in mnet/xmlrpc/client.php...

CVE-2011-4305: Undefined Security Weakness

message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service infinite request loop via a URL that specifies a zero wait time for message refreshing...

CVE-2011-4298: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in mod/wiki/ components in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allow remote attackers to hijack the authentication of arbitrary users for requests that modify wiki data...

PT-2012-1853 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 1.9.x through 1.9.13 Description: The issue allows remote authenticated users to cause a denial of service, resulting in an infinite request loop. This is achieved by specifying a zero wait time for message refreshing in the...

PT-2012-1852 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description: The issue affects the chat functionality, allowing remote authenticated users to discover the name of any user via a beep operation. Recommendations: For...

CVE-2011-4308: Undefined Security Weakness

mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors...

PT-2012-1856

Name of the Vulnerable Software and Affected Versions Moodle versions 1.9.x through 1.9.13 Moodle versions 2.0.x through 2.0.4 Moodle versions 2.1.x through 2.1.1 Description The issue allows remote authenticated users to discover the names of other users via unspecified vectors in the...