Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Moodle
(Moodle)| Repositories |
• https://github.com/moodle/moodle
• https://github.com/tinymce/tinymce_spellchecker_php |
| #Vulnerabilities | 521 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2018-05-25 | CVE-2018-1137 | An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack. | Moodle | 8.1 | ||
| 2018-05-25 | CVE-2018-1136 | An issue was discovered in Moodle 3.x. An authenticated user is allowed to add HTML blocks containing scripts to their Dashboard; this is normally not a security issue because a personal dashboard is visible to this user only. Through this security vulnerability, users can move such a block to other pages where they can be viewed by other users. | Moodle | 4.3 | ||
| 2018-05-25 | CVE-2018-1135 | An issue was discovered in Moodle 3.x. Students who posted on forums and exported the posts to portfolios can download any stored Moodle file by changing the download URL. | Moodle | 6.5 | ||
| 2018-05-25 | CVE-2018-1134 | An issue was discovered in Moodle 3.x. Students who submitted assignments and exported them to portfolios can download any stored Moodle file by changing the download URL. | Moodle | 6.5 | ||
| 2018-01-22 | CVE-2018-1045 | In Moodle 3.x, there is XSS via a calendar event name. | Moodle | 5.4 | ||
| 2018-01-22 | CVE-2018-1044 | In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings. | Moodle | 4.3 | ||
| 2018-01-22 | CVE-2018-1043 | In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames. | Moodle | 6.5 | ||
| 2017-05-15 | CVE-2017-7491 | In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting. | Moodle | 4.3 | ||
| 2017-03-29 | CVE-2017-7298 | In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. | Moodle | 5.4 | ||
| 2017-03-26 | CVE-2017-2645 | In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. | Moodle | 6.1 |