Open Source Vulnerabilities

moodle/moodle

Moodle allows remote authenticated users to cause a denial of service (invalid database records)

moodle/moodle

Moodle vulnerable to Cross-site Scripting

moodle/moodle

Moodle Incorrect Default Settings

moodle/moodle

Moodle does not force password changes for autosubscribed users

moodle/moodle

Moodle allows remote attackers to obtain sensitive information from myprofile block by visiting user-context page

moodle/moodle

Moodle vulnerable to XSS via bundled spikephpcoverage library

moodle/moodle

Moodle vulnerable to Cross-Site Request Forgery

moodle/moodle

Moodle does not use the forceloginforprofiles setting for course-profiles access control

moodle/moodle, moodle/moodle

Moodle does not properly restrict comment capabilities

moodle/moodle, moodle/moodle

Moodle does not properly restrict access to category and course data

moodle/moodle, moodle/moodle

Moodle vulnerable to Cross-Site Scripting

moodle/moodle

Moodle Open Redirect in Calendar Set Page

moodle/moodle, moodle/moodle

Moodle vulnerable to Cross-Site Request Forgery

moodle/moodle, moodle/moodle

Moodle Double-Caches Content, Potentially Writing to a File System's Tmp Directory

moodle/moodle

Moodle XSS Vulnerability

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Open Redirect Via Error Messages

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Allows Modification of Constants

apereo/phpcas, moodle/moodle, moodle/moodle

phpCAS client library and Moodle Cross-site Scripting vulnerability

moodle/moodle, moodle/moodle

Moodle XSS In Tag Autocomplete functionality

moodle/moodle, moodle/moodle

Moodle vulnerable to Cross-site Scripting

moodle/moodle, moodle/moodle

Moodle vulnerable to SQL injection

moodle/moodle, moodle/moodle

Moodle allows remote attackers to obtain sensitive information

moodle/moodle, moodle/moodle

Moodle vulnerable to Cross-site Scripting

moodle/moodle

Moodle vulnerable to Cross-Site Request Forgery

moodle/moodle, moodle/moodle

Moodle is vulnerable to unauthorized new accounts creation

moodle/moodle, moodle/moodle

Moodle vulnerable to Cross-site Scripting

moodle/moodle

Moodle Session Fixation vulnerability

moodle/moodle, moodle/moodle

Moodle doesn't properly check role

moodle/moodle, moodle/moodle

Moodle Authentication Bypass in Question-Bank

moodle/moodle, moodle/moodle

Moodle Exposes Sensitive User Information

moodle/moodle, moodle/moodle

Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter

moodle/moodle, moodle/moodle, moodle/moodle

Moodle CRLF Injection Vulnerability in Calendar Component

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Users Can Bypass Deleted Status

moodle/moodle, moodle/moodle, moodle/moodle

Moodle Allows Unauthenticated Dropbox Access

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module

moodle/moodle, moodle/moodle, moodle/moodle

Moodle's login_as feature leaks information from external repositories

moodle/moodle, moodle/moodle, moodle/moodle

Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class

moodle/moodle

Moodle Authentication Bypass in File Upload

moodle/moodle, moodle/moodle, moodle/moodle

Moodle does not enforce capability requirements for reading blog comments

moodle/moodle, moodle/moodle, moodle/moodle

Moodle does not consider "don't send" attributes during hub registration

moodle/moodle, moodle/moodle, moodle/moodle

Moodle does not properly manage privileges for WebDAV repositories

moodle/moodle, moodle/moodle, moodle/moodle

Moodle allows remote authenticated users to reassign notes

moodle/moodle, moodle/moodle

Moodle is vulnerable to Sensitive Information Disclosure

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle does not enforce the forceloginforprofiles setting

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle includes the WebDAV password in the configuration form

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle reveals absolute path in exception message

yui, moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

YUI Cross-site Scripting (XSS) vulnerability

moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

Moodle Arbitrary File Read via Backup Functionality

yui, moodle/moodle, moodle/moodle, moodle/moodle, moodle/moodle

YUI Cross-site Scripting (XSS) vulnerability