Moodle — система управления образовательными электронными курсами

badges/mybadges.php in Moodle 2.5.x before 2.5.5 and 2.6.x before 2.6. ...

The time-validation implementation in (1) mod/feedback/complete.php an ...

The wiki subsystem in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x ...

repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4 ...

The identity-reporting implementations in mod/forum/renderer.php and m ...

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not prope ...

Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2, allow remote attackers to inject arbitrary web script or HTML by (1) providing a crafted playerId or (2) referencing an external domain, a related issue to CVE-2013-7342.

repository/alfresco/lib.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 places a session key in a URL, which allows remote attackers to bypass intended Alfresco Repository file restrictions by impersonating a file's owner.

mod/assign/externallib.php in Moodle 2.6.x before 2.6.2 does not properly handle assignment web-service parameters, which might allow remote authenticated users to modify grade metadata via unspecified vectors.

mod/chat/chat_ajax.php in Moodle through 2.3.11, 2.4.x before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 does not properly check for the mod/chat:chat capability during chat sessions, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by remaining in a chat session after an intra-session capability removal by an administrator.