Moodle — система управления образовательными электронными курсами
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 541
CVE-2024-33997
Additional sanitizing was required when opening the equation editor to ...
CVE-2024-33996
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
CVE-2024-33996
Incorrect validation of allowed event types in a calendar web service ...
CVE-2024-33998
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
CVE-2024-33997
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.
CVE-2024-33996
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.
CVE-2024-34000
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
CVE-2024-33999
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
CVE-2024-34001
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.
BDU:2024-05157
Уязвимость системы управления Moodle, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнять произвольные команды
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2024-33997 Additional sanitizing was required when opening the equation editor to ... | CVSS3: 6.1 | 1% Низкий | больше 1 года назад |
 | CVE-2024-33996 Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to. | CVSS3: 6.2 | 0% Низкий | больше 1 года назад |
| CVE-2024-33996 Incorrect validation of allowed event types in a calendar web service ... | CVSS3: 6.2 | 0% Низкий | больше 1 года назад |
 | CVE-2024-33998 Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. | CVSS3: 5.4 | 1% Низкий | больше 1 года назад |
| CVE-2024-33997 Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation. | CVSS3: 6.1 | 1% Низкий | больше 1 года назад |
| CVE-2024-33996 Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to. | CVSS3: 6.2 | 0% Низкий | больше 1 года назад |
| CVE-2024-34000 ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. | CVSS3: 4.3 | 0% Низкий | больше 1 года назад |
| CVE-2024-33999 The referrer URL used by MFA required additional sanitizing, rather than being used directly. | CVSS3: 9.8 | 1% Низкий | больше 1 года назад |
| CVE-2024-34001 Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. | CVSS3: 8.4 | 0% Низкий | больше 1 года назад |
 | BDU:2024-05157 Уязвимость системы управления Moodle, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнять произвольные команды | CVSS3: 6.2 | 0% Низкий | больше 1 года назад |
Уязвимостей на страницу