MO
Product
Moodle
637
CVEs
0
On KEV
10.0
Max CVSS
12
New 30D
Severity mix
Critical 20High 80Medium 247Low 11
Watch
Add Moodle to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-3552 | – | Jul 29 | The Shibboleth authentication plugin in auth/shibboleth/index.php in Moodle through 2.3.11, 2.4.x before 2.4.11, and 2.5.x before 2.5.7 does not check whether a session ID is… Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +24 more |
| CVE-2014-3551 | – | Jul 29 | Multiple cross-site scripting (XSS) vulnerabilities in the advanced-grading implementation in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4,… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +29 more |
| CVE-2014-3550 | – | Jul 29 | Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or… Affected: 2.7.0 |
| CVE-2014-3549 | – | Jul 29 | Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject… Affected: 2.7.0 |
| CVE-2014-3548 | – | Jul 29 | Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote… Affected: through 2.3.11; 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; +29 more |
| CVE-2014-3547 | – | Jul 29 | Multiple cross-site scripting (XSS) vulnerabilities in badges/renderer.php in Moodle 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allow remote attackers to… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.5.4; 2.5.5; +6 more |
| CVE-2014-3546 | – | Jul 29 | Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 does not enforce certain capability requirements in (1) notes/index.php… Affected: 2.6.0; 2.6.1; 2.6.2; 2.6.3; through 2.3.11; 2.3.0; +29 more |
| CVE-2014-3545 | – | Jul 29 | Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a… Affected: 2.7.0; 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; +29 more |
| CVE-2014-3544 | – | Jul 29 | Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows… Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +29 more |
| CVE-2014-3543 | – | Jul 29 | mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary… Affected: through 2.3.11; 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; +29 more |
| CVE-2014-3542 | – | Jul 29 | mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files… Affected: 2.7.0; 2.6.0; 2.6.1; 2.6.2; 2.6.3; through 2.3.11; +29 more |
| CVE-2014-3541 | – | Jul 29 | The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP… Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +29 more |
| CVE-2014-0218 | – | May 27 | Cross-site scripting (XSS) vulnerability in the URL downloader repository in repository/url/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0217 | – | May 27 | enrol/index.php in Moodle 2.6.x before 2.6.3 does not check for the moodle/course:viewhiddencourses capability before listing hidden courses, which allows remote attackers to… Affected: 2.6.0; 2.6.1; 2.6.2 |
| CVE-2014-0216 | – | May 27 | The My Home implementation in the block_html_pluginfile function in blocks/html/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0215 | – | May 27 | The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0214 | – | May 27 | login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service token with an infinite lifetime, which… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0213 | – | May 27 | Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-2572 | – | Mar 24 | mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade… Affected: 2.6.0; 2.6.1 |
| CVE-2014-2571 | – | Mar 24 | Cross-site scripting (XSS) vulnerability in the quiz_question_tostring function in mod/quiz/editlib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0127 | – | Mar 24 | The time-validation implementation in (1) mod/feedback/complete.php and (2) mod/feedback/complete_guest.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0129 | – | Mar 24 | badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6.2 does not properly track the user to whom a badge was issued, which allows remote authenticated users to… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0126 | – | Mar 24 | Cross-site request forgery (CSRF) vulnerability in enrol/imsenterprise/importnow.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0125 | – | Mar 24 | repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0124 | – | Mar 24 | The identity-reporting implementations in mod/forum/renderer.php and mod/quiz/override_form.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0123 | – | Mar 24 | The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly restrict (1) view and (2) edit access, which allows… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0122 | – | Mar 24 | mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2013-7341 | – | Mar 24 | Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before… Affected: through 2.3.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; +34 more |
| CVE-2014-0010 | – | Jan 20 | Multiple cross-site request forgery (CSRF) vulnerabilities in user/profile/index.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and… Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.4.5; +34 more |
| CVE-2014-0009 | – | Jan 20 | course/loginas.php in Moodle through 2.2.11, 2.3.x before 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 does not enforce the moodle/site:accessallgroups… Affected: 2.6.0; through 2.2.11; 2.0.0; 2.0.1; 2.0.2; 2.0.3; +34 more |
| CVE-2014-0008 | – | Jan 20 | lib/adminlib.php in Moodle through 2.3.11, 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 logs cleartext passwords, which allows remote authenticated… Affected: 2.5.0; 2.5.1; 2.5.2; 2.5.3; 2.6.0; 2.4.0; +19 more |
| CVE-2013-4525 | – | Nov 26 | Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3… Affected: through 2.2.11; 1.1.1; 1.2.0; 1.2.1; 1.3.0; 1.3.1; +34 more |
| CVE-2013-4524 | – | Nov 26 | Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote… Affected: through 2.2.11; 1.1.1; 1.2.0; 1.2.1; 1.3.0; 1.3.1; +34 more |
| CVE-2013-4523 | – | Nov 26 | Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated… Affected: through 2.2.11; 1.1.1; 1.2.0; 1.2.1; 1.3.0; 1.3.1; +34 more |
| CVE-2013-4522 | – | Nov 26 | lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote… Affected: through 2.2.11; 1.1.1; 1.2.0; 1.2.1; 1.3.0; 1.3.1; +34 more |
| CVE-2013-3630 | – | Nov 1 | Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within… Affected: through 2.5.2; 1.1.1; 1.2.0; 1.2.1; 1.3.0; 1.3.1; +34 more |
| CVE-2013-4341 | – | Sep 16 | Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 allow remote attackers to inject… Affected: through 2.2.11; 2.3.0; 2.3.1; 2.3.2; 2.3.3; 2.3.4; +12 more |
| CVE-2013-5674 | – | Sep 16 | badges/external.php in Moodle 2.5.x before 2.5.2 does not properly handle an object obtained by unserializing a description of an external badge, which allows remote attackers to… Affected: 2.5.0; 2.5.1 |
| CVE-2013-4313 | – | Sep 16 | Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not prevent use of '\0' characters in query strings, which might allow remote attackers… Affected: through 2.2.11; 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +23 more |
| CVE-2012-6087 | – | Sep 16 | repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname… Affected: through 2.2.11; 2.2.0; 2.2.1; 2.2.2; 2.2.3; 2.2.4; +23 more |
| CVE-2013-4942 | – | Jul 29 | Cross-site scripting (XSS) vulnerability in flashuploader.swf in the Uploader component in Yahoo! YUI 3.5.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11,… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-4941 | – | Jul 29 | Cross-site scripting (XSS) vulnerability in uploader.swf in the Uploader component in Yahoo! YUI 3.2.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-4940 | – | Jul 29 | Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8,… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-4939 | – | Jul 29 | Cross-site scripting (XSS) vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.0.0 through 3.9.1, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-4938 | – | Jul 29 | The LTI (aka IMS-LTI) mod_form implementation in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-2246 | – | Jul 29 | mod/feedback/lib.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/feedback:view… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-2245 | – | Jul 29 | rss/file.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not properly implement the use of RSS tokens for… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-2244 | – | Jul 29 | Multiple cross-site scripting (XSS) vulnerabilities in lib/conditionlib.php in Moodle 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allow remote attackers to inject arbitrary web… Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4; 2.5.0 |
| CVE-2013-2243 | – | Jul 29 | mod/lesson/pagetypes/matching.php in Moodle through 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 allows remote authenticated users to obtain sensitive… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
| CVE-2013-2242 | – | Jul 29 | mod/chat/gui_sockets/index.php in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, and 2.5.x before 2.5.1 does not consider the mod/chat:chat… Affected: 2.1.0; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +30 more |
The 500 most important CVEs for this product (exploited first, then by severity)