Moodle is vulnerable to information disclosure. Moodle redirects users from an HTTPS url to an HTTP url in auth/ldap/ntlmsso_attempt.php
allowing the attackers to obtain sensitive information through sniffing the network.
git.moodle.org/gw?p=moodle.git%3Ba=commit%3Bh=9d8d2ee6192e8b7ebb6713bd6215e06f94e2a9f7
git.moodle.org/gw?p=moodle.git;a=commit;h=9d8d2ee6192e8b7ebb6713bd6215e06f94e2a9f7
openwall.com/lists/oss-security/2012/07/17/1
secunia.com/advisories/49890
www.securityfocus.com/bid/54481
exchange.xforce.ibmcloud.com/vulnerabilities/76960