CVEs (625)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Moodle 3.x has Server Side Request Forgery in the filepicker. |
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility....Show more |
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access. |
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
In Moodle 3.x, course creators are able to change system default settings for courses. |
In Moodle 3.3, the course overview block reveals activities in hidden courses. |
Moodle 3.x has user fullname disclosure on the user preferences page. |
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting. |
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing. |
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link. |
Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of...Show more |
The "restore teacher" feature in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to overwrite the course idnumber. |
The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users. |
Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, and 2.8 through 2.8.11 allows remote attackers to obtain the names of hidden forums and forum discussions. |
The user editing form in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to edit profile fields locked by the administrator. |
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. |
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. |
In Moodle 3.x, XSS can occur via evidence of prior learning. |
In Moodle 3.2.x, global search displays user names for unauthenticated users. |
In Moodle 2.x and 3.x, SQL injection can occur via user preferences. |