Moodle

Moodle

624 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.8

CVE-2010-2231

  • EPSS 0.54%
  • Veröffentlicht 28.06.2010 17:30:01
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz atte...

6.8

CVE-2010-1613

  • EPSS 0.45%
  • Veröffentlicht 29.04.2010 21:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.

4.3

CVE-2010-1614

  • EPSS 0.25%
  • Veröffentlicht 29.04.2010 21:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search featu...

7.5

CVE-2010-1615

  • EPSS 0.44%
  • Veröffentlicht 29.04.2010 21:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "d...

4

CVE-2010-1616

  • EPSS 0.28%
  • Veröffentlicht 29.04.2010 21:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.

4

CVE-2010-1617

  • EPSS 0.27%
  • Veröffentlicht 29.04.2010 21:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.

4.3

CVE-2010-1618

  • EPSS 0.27%
  • Veröffentlicht 29.04.2010 21:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in the phpCAS client library before 1.1.0, as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via a crafted URL, which is not properly ...

4.3

CVE-2010-1619

  • EPSS 0.25%
  • Veröffentlicht 29.04.2010 21:30:00
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web scri...

6.8

CVE-2009-4297

  • EPSS 0.4%
  • Veröffentlicht 16.12.2009 01:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.

5

CVE-2009-4298

  • EPSS 0.75%
  • Veröffentlicht 16.12.2009 01:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.