Moodle cross-site request forgery (CSRF) vulnerability

Moodle CRLF Injection Vulnerability in Calendar Component

Moodle Cross-site Scripting (XSS)

Moodle allows reflected XSS via question bank filter

Cross-site scripting (XSS) vulnerability in mod/forum/discuss.php in Moodle 1.6.1 allows remote attackers to inject arbitrary web script or HTML via the navtail parameter. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.

Moodle vulnerable to Server-Side Request Forgery

Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.6.1 and earlier might allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) doc/index.php or (2) files/index.php.

Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 displays web service tokens associated with (1) disabled services and (2) users who no longer have authorization, which allows remote authenticated users to have an unspecified impact by reading these tokens.

Moodle XSS Vulnerability

Moodle denial-of-service risk in the draft files area

Moodle broken access control when setting calendar event type

theme/yui_combo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response.

Moodle allows attackers to bypass intended login restrictions

Moodle Cross-site Scripting in the Course summary filter of the Add a new course

Moodle allows attackers to bypass a messaging-disabled setting

The chat functionality in Moodle 2.0.x before 2.0.5 and 2.1.x before 2.1.2 allows remote authenticated users to discover the name of any user via a beep operation.

Moodle has an arbitrary file read risk through pdfTeX

Moodle Cross-site Scripting vulnerability

Moodle has insufficient capability checks

A vulnerability was found in a Moodle TeX filter administrative setting where insufficient sanitization of configuration input could allow command injection. On sites where the TeX filter is enabled and ImageMagick is installed, a maliciously crafted setting value entered by an administrator could result in unintended system command execution. While exploitation requires administrative privileges, successful compromise could affect the entire Moodle server.