CVE-2012-1160

Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php...

CVE-2012-1160

Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php...

PT-2019-6742

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.2.2 Description The issue concerns a permission problem in Forum Subscriptions. Unenrolled users can subscribe or unsubscribe through the mod/forum/index.php endpoint, specifically the mod/forum/index.php API endpoin...

CVE-2012-1160: Incorrect Permission Assignment for Critical Resource

Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php...

Moodle CMS 3.6.x <= 3.6.2 Authentication Bypass Vulnerability

Moodle CMS is prone to an authentication bypass vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free...

Moodle 2.5.x < 2.5.5 Multiple Vulnerabilities

Binary data 9423.prm...

Moodle Access Bypass

The vulnerability of the mod/forum/post.php function in the Moodle learning management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to circumvent existing access restrictions through group-based authenticatio...

PT-2016-1289

Name of the Vulnerable Software and Affected Versions Moodle versions 2.9.x through 2.9.0 Description The issue is related to insufficient access control in the mod/forum/post.php function of the Moodle learning management system. This can be exploited by a remote attacker to bypass existing acce...

CVE-2015-3273: Undefined Security Weakness

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization...

CVE-2014-7834: Undefined Security Weakness

mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forumgetdiscussions web service...

PT-2014-8301

Name of the Vulnerable Software and Affected Versions Moodle versions 2.6.x through 2.6.5 Moodle versions 2.7.x through 2.7.2 Description The issue allows remote authenticated users to access a forum without proper group permission verification. This is due to a problem in the...

CVE-2014-3617

The CVE-2014-3617 issue affects Moodle’s forum: the function forum_print_latest_discussions in mod/forum/lib.php allowed remote authenticated users to bypass the requirement to post an answer and to discover an author’s username by visiting a Q&A forum, without needing the mod/forum:viewqandawith...

CVE-2014-3617

The forumprintlatestdiscussions function in mod/forum/lib.php in Moodle through 2.4.11, 2.5.x before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2 allows remote authenticated users to bypass the individual answer-posting requirement without the mod/forum:viewqandawithoutposting capability, an...

PT-2014-5422

Name of the Vulnerable Software and Affected Versions Moodle versions prior to 2.4.11 Moodle versions 2.5.x prior to 2.5.8 Moodle versions 2.6.x prior to 2.6.5 Moodle versions 2.7.x prior to 2.7.2 Description The issue allows remote authenticated users to bypass the individual answer-posting...

PT-2014-5391

Name of the Vulnerable Software and Affected Versions Moodle versions 2.3.11 and earlier, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, 2.7.x before 2.7.1 Description The issue allows remote authenticated users to bypass intended access restrictions by leveraging two or more group...

Code injection

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2014-0124

The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/overrideform.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 do not properly restrict the display of e-mail addresses, which allows remote authenticated users to obtain...

CVE-2012-3392

mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums...

CVE-2012-3391

mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote authenticated users to bypass intended access restrictions by leveraging the student role and reading the RSS feed for a...

PT-2012-4685

Name of the Vulnerable Software and Affected Versions Moodle versions 2.1.x through 2.1.6 Moodle versions 2.2.x through 2.2.3 Description The issue allows remote authenticated users to bypass forum-subscription requirements by leveraging the student role and unsubscribing from all forums, due to...