Filtered by vendor Moodle Subscriptions
Filtered by product Moodle Subscriptions

Search

Switch to Advanced Search (Beta)
Total 556 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2018-10890 1 Moodle 1 Moodle 2024-11-21 N/A
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.
CVE-2018-10889 1 Moodle 1 Moodle 2024-11-21 N/A
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
CVE-2017-7532 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.x, course creators are able to change system default settings for courses.
CVE-2017-7531 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.3, the course overview block reveals activities in hidden courses.
CVE-2017-7491 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.
CVE-2017-7490 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.
CVE-2017-7489 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.
CVE-2017-7298 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element.
CVE-2017-2645 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.
CVE-2017-2644 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.x, XSS can occur via evidence of prior learning.
CVE-2017-2643 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.2.x, global search displays user names for unauthenticated users.
CVE-2017-2642 1 Moodle 1 Moodle 2024-11-21 N/A
Moodle 3.x has user fullname disclosure on the user preferences page.
CVE-2017-2641 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 2.x and 3.x, SQL injection can occur via user preferences.
CVE-2017-2578 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.x, there is XSS in the assignment submission page.
CVE-2017-2576 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums.
CVE-2017-15110 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students.
CVE-2017-12157 1 Moodle 1 Moodle 2024-11-21 N/A
In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
CVE-2017-12156 1 Moodle 1 Moodle 2024-11-21 N/A
Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.
CVE-2016-9188 1 Moodle 1 Moodle 2024-11-21 N/A
Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters.
CVE-2016-9187 1 Moodle 1 Moodle 2024-11-21 N/A
Unrestricted file upload vulnerability in the double extension support in the "image" module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, and then accessing it via unspecified vectors.