Moodle

moodle

639 CVEs • 3 products

Products (3)

Click to collapse

Toggle

Virtual Programming Lab

virtual_programming_lab

1 CVE

CVEs (639)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2008-5153 1Moodle 1Moodle Apr 23, 2026 Nov 18, 2008 N/A· v4 N/A· v3 6.9 MEDIUM· v2 spell-check-logic.cgi in Moodle 1.8.2 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/spell-check-debug.log, (2) /tmp/spell-check-before, or (3) /tmp/spell-check-after temporary file.
CVE-2008-3327 1Moodle 1Moodle Apr 23, 2026 Jul 25, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Moodle 1.6.5, when display_errors is enabled, allows remote attackers to obtain sensitive information via a direct request to (1) blog/blogpage.php and (2) course/report/stats/report.php, which reveals the installation p...Show more Moodle 1.6.5, when display_errors is enabled, allows remote attackers to obtain sensitive information via a direct request to (1) blog/blogpage.php and (2) course/report/stats/report.php, which reveals the installation path in an error message.Show less
CVE-2008-3326 1Moodle 1Moodle Apr 23, 2026 Jul 25, 2008 N/A· v4 N/A· v3 2.6 LOW· v2 Cross-site scripting (XSS) vulnerability in blog/edit.php in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to inject arbitrary web script or HTML via the etitle parameter (blog entry title).
CVE-2008-3325 2Debian Moodle 2Debian Linux Moodle Apr 23, 2026 Jul 25, 2008 N/A· v4 N/A· v3 6.0 MEDIUM· v2 Cross-site request forgery (CSRF) vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user...Show more Cross-site request forgery (CSRF) vulnerability in Moodle 1.6.x before 1.6.7 and 1.7.x before 1.7.5 allows remote attackers to modify profile settings and gain privileges as other users via a link or IMG tag to the user edit profile page.Show less
CVE-2008-1502 2Egroupware Moodle 2Egroupware Moodle Apr 23, 2026 Mar 25, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cros...Show more The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a string containing crafted URL protocols.Show less
CVE-2008-0123 1Moodle 1Moodle Apr 23, 2026 Jan 12, 2008 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this iss...Show more Cross-site scripting (XSS) vulnerability in install.php for Moodle 1.8.3, and possibly other versions before 1.8.4, allows remote attackers to inject arbitrary web script or HTML via the dbname parameter. NOTE: this issue only exists until the installation is complete.Show less
CVE-2007-3555 1Moodle 1Moodle Apr 23, 2026 Jul 4, 2007 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004...Show more Cross-site scripting (XSS) vulnerability in index.php in Moodle 1.7.1 allows remote attackers to inject arbitrary web script or HTML via a style expression in the search parameter, a different vulnerability than CVE-2004-1424.Show less
CVE-2007-1647 1Moodle 1Moodle Apr 23, 2026 Mar 24, 2007 N/A· v4 N/A· v3 7.8 HIGH· v2 Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other s...Show more Moodle 1.5.2 and earlier stores sensitive information under the web root with insufficient access control, and provides directory listings, which allows remote attackers to obtain user names, password hashes, and other sensitive information via a direct request for session (sess_*) files in moodledata/sessions/.Show less
CVE-2007-1429 1Moodle 1Moodle Apr 23, 2026 Mar 13, 2007 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple PHP remote file inclusion vulnerabilities in Moodle 1.7.1 allow remote attackers to execute arbitrary PHP code via a URL in the cmd parameter to (1) admin/utfdbmigrate.php or (2) filter.php.
CVE-2006-6626 1Moodle 1Moodle Apr 23, 2026 Dec 18, 2006 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in an unspecified component of Moodle 1.5 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element. NOTE: The pro...Show more Cross-site scripting (XSS) vulnerability in an unspecified component of Moodle 1.5 allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the SRC attribute of an IMG element. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information. NOTE: It is unclear whether this candidate overlaps CVE-2006-4784 or CVE-2006-4941.Show less
CVE-2006-6625 1Moodle 1Moodle Apr 23, 2026 Dec 18, 2006 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in mod/forum/discuss.php in Moodle 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the navtail parameter. NOTE: The provenance of this information is unk...Show more Cross-site scripting (XSS) vulnerability in mod/forum/discuss.php in Moodle 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the navtail parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.Show less
CVE-2006-5219 1Moodle 1Moodle Apr 23, 2026 Oct 10, 2006 N/A· v4 N/A· v3 5.1 MEDIUM· v2 SQL injection vulnerability in blog/index.php in the blog module in Moodle 1.6.2 allows remote attackers to execute arbitrary SQL commands via a double-encoded tag parameter.
CVE-2006-4943 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 5.0 MEDIUM· v2 course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump paramete...Show more course/jumpto.php in Moodle before 1.6.2 does not validate the session key (sesskey) before providing content from arbitrary local URIs, which allows remote attackers to obtain sensitive information via the jump parameter.Show less
CVE-2006-4942 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 4.6 MEDIUM· v2 Moodle before 1.6.2, when the configuration lacks (1) algebra or (2) tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via (a) filter/algebra...Show more Moodle before 1.6.2, when the configuration lacks (1) algebra or (2) tex filters, allows remote authenticated users to write LaTeX or MimeTeX output files to the top level of the dataroot directory via (a) filter/algebra/pix.php or (b) filter/tex/pix.php.Show less
CVE-2006-4941 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Multiple cross-site scripting (XSS) vulnerabilities in Moodle before 1.6.2 might allow remote attackers to inject arbitrary web script or HTML via (1) the choose parameter in files/index.php and (2) the sub parameter in...Show more Multiple cross-site scripting (XSS) vulnerabilities in Moodle before 1.6.2 might allow remote attackers to inject arbitrary web script or HTML via (1) the choose parameter in files/index.php and (2) the sub parameter in doc/index.php.Show less
CVE-2006-4940 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 5.0 MEDIUM· v2 login/forgot_password.php in Moodle before 1.6.2 allows remote attackers to obtain sensitive information (e-mail addresses and Moodle account names) via a find action.
CVE-2006-4939 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 5.0 MEDIUM· v2 backup/backup_scheduled.php in Moodle before 1.6.2 generates trace data with the full backup pathname even when debugging is disabled, which might allow attackers to obtain the pathname.
CVE-2006-4938 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 4.0 MEDIUM· v2 help.php in Moodle before 1.6.2 does not check the existence of certain help files before including them, which might allow remote authenticated users to obtain the path in an error message.
CVE-2006-4937 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 4.0 MEDIUM· v2 lib/setup.php in Moodle before 1.6.2 sets the error reporting level to 7 to display E_WARNING messages to users even if debugging is disabled, which might allow remote authenticated users to obtain sensitive information...Show more lib/setup.php in Moodle before 1.6.2 sets the error reporting level to 7 to display E_WARNING messages to users even if debugging is disabled, which might allow remote authenticated users to obtain sensitive information by triggering the messages.Show less
CVE-2006-4936 1Moodle 1Moodle Apr 16, 2026 Sep 23, 2006 N/A· v4 N/A· v3 10.0 HIGH· v2 Moodle before 1.6.2 does not properly validate the module instance id when creating a course module object, which has unspecified impact and remote attack vectors.

Previous 1...28 29 303132 Next