Moodle — система управления образовательными электронными курсами

Уязвимость системы управления обучением Мoodle, позволяющая нарушителю игнорировать принудительную смену пароля

Уязвимость системы управления обучением Мoodle, позволяющая нарушителю получить доступ к защищаемой информации

Уязвимость системы управления обучением Мoodle, позволяющая нарушителю пройти процедуру аутентификации

The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not properly restrict the parameters used in a return URL, which allows remote attackers to trigger the generation of arbitrary messages via a modified URL, related to mod/lti/locallib.php and mod/lti/return.php.

The LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x bef ...

lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide charset information in HTTP headers, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via UTF-7 characters during interaction with AJAX scripts.

lib/setup.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x befo ...

lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.

lib/phpunit/bootstrap.php in Moodle 2.6.x before 2.6.6 and 2.7.x befor ...

iplookup/index.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote attackers to cause a denial of service (resource consumption) by triggering the calculation of an estimated latitude and longitude for an IP address.