MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2013-2083 | – | May 25 | The MoodleQuickForm class in lib/formslib.php in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +26 more |
| CVE-2013-2082 | – | May 25 | Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not enforce capability requirements for reading blog comments, which allows remote… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +26 more |
| CVE-2013-2081 | – | May 25 | Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not consider "don't send" attributes during hub registration, which allows remote hubs… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +26 more |
| CVE-2013-2080 | – | May 25 | The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +16 more |
| CVE-2013-2079 | – | May 25 | mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP… Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; 2.3.5; +5 more |
| CVE-2013-1836 | – | Mar 25 | Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +30 more |
| CVE-2013-1835 | – | Mar 25 | Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +30 more |
| CVE-2013-1834 | – | Mar 25 | notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign… Affected: 1.9.1; 1.9.2; 1.9.3; 1.9.4; 1.9.5; 1.9.6; +34 more |
| CVE-2013-1833 | – | Mar 25 | Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +30 more |
| CVE-2013-1832 | – | Mar 25 | repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form,… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +30 more |
| CVE-2013-1831 | – | Mar 25 | lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid… Affected: 1.1.1; 1.2.0; 1.2.1; 1.3.0; 1.3.1; 1.3.2; +34 more |
| CVE-2013-1830 | – | Mar 25 | user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +34 more |
| CVE-2013-1829 | – | Mar 25 | calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated… Affected: 2.4.0; 2.4.1 |
| CVE-2012-6112 | – | Jan 27 | classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +16 more |
| CVE-2012-6106 | – | Jan 27 | calendar/managesubscriptions.php in the Manage Subscriptions implementation in Moodle 2.4.x before 2.4.1 omits a capability check, which allows remote authenticated users to… Affected: 2.4.0 |
| CVE-2012-6105 | – | Jan 27 | blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled,… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +16 more |
| CVE-2012-6104 | – | Jan 27 | blog/rsslib.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allows remote attackers to obtain sensitive information from site-level blogs by… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +6 more |
| CVE-2012-6103 | – | Jan 27 | Multiple cross-site request forgery (CSRF) vulnerabilities in user/messageselect.php in the messaging system in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +6 more |
| CVE-2012-6102 | – | Jan 27 | lib.php in the Submission comments plugin in the Assignment module in Moodle 2.3.x before 2.3.4 and 2.4.x before 2.4.1 allows remote attackers to read or modify the submission… Affected: 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.4.0 |
| CVE-2012-6101 | – | Jan 27 | Multiple open redirect vulnerabilities in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 allow remote attackers to redirect users to arbitrary web sites and… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +6 more |
| CVE-2012-6100 | – | Jan 27 | report/outline/index.php in Moodle 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/user:viewhiddendetails capability… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; +6 more |
| CVE-2012-6099 | – | Jan 27 | The moodle1 backup converter in backup/converter/moodle1/lib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +16 more |
| CVE-2012-6098 | – | Jan 27 | grade/edit/outcome/edit_form.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the… Affected: 1.9.1; 1.9.2; 1.9.3; 1.9.4; 1.9.5; 1.9.6; +34 more |
| CVE-2012-5481 | – | Nov 21 | Moodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the moodle/role:manage capability requirement and read all capability data by visiting the Check Permissions… Affected: 2.3.0; 2.3.1; 2.3.2 |
| CVE-2012-5480 | – | Nov 21 | The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass intended restrictions on reading other… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +12 more |
| CVE-2012-5479 | – | Nov 21 | The Portfolio plugin in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to upload and execute files via a modified… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +12 more |
| CVE-2012-5473 | – | Nov 21 | The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to read activity entries of a different… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +12 more |
| CVE-2012-5472 | – | Nov 21 | lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to bypass intended access restrictions via a modified value of a frozen form… Affected: 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.2.5; 2.3.1; +1 more |
| CVE-2012-5471 | – | Nov 21 | The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +12 more |
| CVE-2012-4408 | – | Sep 19 | course/reset.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 checks an update capability instead of a reset capability, which allows remote… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +9 more |
| CVE-2012-4407 | – | Sep 19 | lib/filelib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly check the publication state of blog files, which allows remote attackers… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +9 more |
| CVE-2012-4403 | – | Sep 19 | theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation… Affected: 2.3.0; 2.3.1 |
| CVE-2012-4402 | – | Sep 19 | webservice/lib.php in Moodle 2.1.x before 2.1.8, 2.2.x before 2.2.5, and 2.3.x before 2.3.2 does not properly restrict the use of web-service tokens, which allows remote… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +9 more |
| CVE-2012-4401 | – | Sep 19 | Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended capability restrictions and perform certain topic changes by leveraging… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.3.0; +1 more |
| CVE-2012-4400 | – | Sep 19 | repository/repository_ajax.php in Moodle 2.2.x before 2.2.5 and 2.3.x before 2.3.2 allows remote authenticated users to bypass intended upload-size restrictions via a -1 value in… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; 2.3.0; +1 more |
| CVE-2012-3398 | – | Jul 23 | Algorithmic complexity vulnerability in Moodle 1.9.x before 1.9.19, 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to cause a… Affected: 1.9.1; 1.9.2; 1.9.3; 1.9.4; 1.9.5; 1.9.6; +33 more |
| CVE-2012-3397 | – | Jul 23 | lib/modinfolib.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 does not check for a group-membership requirement when determining… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +16 more |
| CVE-2012-3396 | – | Jul 23 | Cross-site scripting (XSS) vulnerability in cohort/edit_form.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 allows remote… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +16 more |
| CVE-2012-3395 | – | Jul 23 | SQL injection vulnerability in mod/feedback/complete.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to execute… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +15 more |
| CVE-2012-3394 | – | Jul 23 | auth/ldap/ntlmsso_attempt.php in Moodle 2.0.x before 2.0.10, 2.1.x before 2.1.7, 2.2.x before 2.2.4, and 2.3.x before 2.3.1 redirects users from an https LDAP login URL to an http… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +6 more |
| CVE-2012-3393 | – | Jul 23 | Cross-site scripting (XSS) vulnerability in repository/lib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 allows remote authenticated administrators to inject arbitrary… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +5 more |
| CVE-2012-3392 | – | Jul 23 | mod/forum/unsubscribeall.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not consider whether a forum is optional, which allows remote authenticated users to bypass… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +5 more |
| CVE-2012-3391 | – | Jul 23 | mod/forum/rsslib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly implement the requirement for posting before reading a Q&A forum, which allows remote… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +5 more |
| CVE-2012-3390 | – | Jul 23 | lib/filelib.php in Moodle 2.1.x before 2.1.7 and 2.2.x before 2.2.4 does not properly restrict file access after a block has been hidden, which allows remote authenticated users… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +5 more |
| CVE-2012-3389 | – | Jul 23 | Multiple cross-site scripting (XSS) vulnerabilities in mod/lti/typessettings.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 allow remote attackers to inject arbitrary web… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.3.0 |
| CVE-2012-3388 | – | Jul 23 | The is_enrolled function in lib/accesslib.php in Moodle 2.2.x before 2.2.4 and 2.3.x before 2.3.1 does not properly interact with the caching feature, which might allow remote… Affected: 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.3.0 |
| CVE-2012-3387 | – | Jul 23 | Moodle 2.3.x before 2.3.1 uses only a client-side check for whether references are permitted in a file upload, which allows remote authenticated users to bypass intended alias… Affected: 2.3.0 |
| CVE-2012-2367 | – | Jul 21 | Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/calendar:manageownentries… Affected: 1.9.1; 1.9.2; 1.9.3; 1.9.4; 1.9.5; 1.9.6; +29 more |
| CVE-2012-2366 | – | Jul 21 | mod/data/preset.php in Moodle 2.1.x before 2.1.6 and 2.2.x before 2.2.3 does not properly iterate through an array, which allows remote authenticated users to overwrite arbitrary… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +3 more |
| CVE-2012-2365 | – | Jul 21 | Cross-site scripting (XSS) vulnerability in Moodle 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to inject arbitrary web script… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +12 more |
The 500 most important CVEs for this product (exploited first, then by severity)