Moodle — система управления образовательными электронными курсами

Moodle does not enforce capability requirements for reading blog comments

Moodle allows remote authenticated users to reassign notes

Moodle is vulnerable to Sensitive Information Disclosure

Moodle does not properly manage privileges for WebDAV repositories

mod/assign/locallib.php in the assignment module in Moodle 2.3.x before 2.3.7 and 2.4.x before 2.4.4 does not consider capability requirements during the processing of ZIP assignment-archive download (aka downloadall) requests, which allows remote authenticated users to read other users' assignments by leveraging the student role.

PHP Spellchecker addon for TinyMCE allows attackers to trigger arbitrary outbound HTTP requests

Moodle does not enforce the forceloginforprofiles setting

Moodle reveals absolute path in exception message

Moodle includes the WebDAV password in the configuration form

blog/rsslib.php in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 continues to provide a blog RSS feed after blogging is disabled, which allows remote attackers to obtain sensitive information by reading this feed.