Moodle

Moodle

601 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.1

CVE-2018-1137

  • EPSS 0.5%
  • Published 25.05.2018 12:29:00
  • Last modified 21.11.2024 03:59:16

An issue was discovered in Moodle 3.x. By substituting URLs in portfolios, users can instantiate any class. This can also be exploited by users who are logged in as guests to create a DDoS attack.

5.3

CVE-2018-1081

  • EPSS 0.93%
  • Published 04.04.2018 21:29:00
  • Last modified 21.11.2024 03:59:08

A flaw was found in Moodle 3.4 to 3.4.1, 3.3 to 3.3.4, 3.2 to 3.2.7, 3.1 to 3.1.10 and earlier unsupported versions. Unauthenticated users can trigger custom messages to admin via paypal enrol script. Paypal IPN callback script should only send error...

8.1

CVE-2018-1082

  • EPSS 1.61%
  • Published 04.04.2018 21:29:00
  • Last modified 21.11.2024 03:59:08

A flaw was found in Moodle 3.4 to 3.4.1, and 3.3 to 3.3.4. If a user account using OAuth2 authentication method was once confirmed but later suspended, the user could still login to the site.

6.5

CVE-2018-1042

  • EPSS 18.99%
  • Published 22.01.2018 08:29:00
  • Last modified 21.11.2024 03:59:03

Moodle 3.x has Server Side Request Forgery in the filepicker.

6.5

CVE-2018-1043

  • EPSS 0.21%
  • Published 22.01.2018 08:29:00
  • Last modified 21.11.2024 03:59:03

In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames.

4.3

CVE-2018-1044

  • EPSS 0.25%
  • Published 22.01.2018 08:29:00
  • Last modified 21.11.2024 03:59:03

In Moodle 3.x, quiz web services allow students to see quiz results when it is prohibited in the settings.

5.4

CVE-2018-1045

  • EPSS 0.3%
  • Published 22.01.2018 08:29:00
  • Last modified 21.11.2024 03:59:03

In Moodle 3.x, there is XSS via a calendar event name.

4.3

CVE-2017-15110

  • EPSS 0.24%
  • Published 20.11.2017 14:29:00
  • Last modified 20.04.2025 01:37:25

In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and gu...

6.1

CVE-2017-12156

  • EPSS 0.22%
  • Published 18.09.2017 04:29:00
  • Last modified 20.04.2025 01:37:25

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.

4.3

CVE-2017-12157

  • EPSS 0.25%
  • Published 18.09.2017 04:29:00
  • Last modified 20.04.2025 01:37:25

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.