CVE-2014-3546

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...

CVE-2014-3546

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in 1 notes/index.php and 2 user/edit.php, which allows remote attackers to obtain potentially sensitive username and course information via a...

CVE-2013-2079

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download aka downloadall requests, which allows remote authenticated users to read other users' assignment...

CVE-2013-2079

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download aka downloadall requests, which allows remote authenticated users to read other users' assignment...

Code injection

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download aka downloadall requests, which allows remote authenticated users to read other users' assignment...

Cross site request forgery (csrf)

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-2079

The CVE-2013-2079 issue affects Moodle’s assignment module (Moodle versions 2.3.x before 2.3.7 and 2.4.x before 2.4.4). The vulnerability arises because mod/assign/locallib.php does not enforce capability requirements when processing ZIP assignment-archive download (downloadall) requests, allowin...

CVE-2013-2082

Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote attackers to obtain sensitive information via a crafted request...

CVE-2013-1959

kernel/usernamespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uidmap and gidmap files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process...

Design/Logic Flaw

The scmcheckcreds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the time interval durin...

CVE-2013-1958

CVE-2013-1958 affects Linux kernels before 3.8.6 where scm_check_creds in net/core/scm.c fails to enforce capabilities for the PID value tied to a UNIX domain socket, allowing local users to bypass access controls during a window when a user namespace exists but a PID namespace is not yet created...

CVE-2013-1829

calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role...

CVE-2012-2356

The question-bank functionality in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 allows remote authenticated users to bypass intended capability requirements and save questions via a savequestion action...