Moodle (Unknown) - vulnerabilities (CVEs)

22 CVEs, 0 in the last 30 days, 21 known versions, newest CVE from 2020-05-21. Vendor: Unknown.

CVEs of Moodle

CVE-2020-10738 - CVSS 8.8 (high), 2020-05-21: A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible…
CVE-2019-14880 - CVSS 9.1 (critical), 2020-03-31: A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users'…
CVE-2019-14883 - CVSS 5.3 (medium), 2020-03-18: A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not…
CVE-2019-14884 - CVSS 6.1 (medium), 2020-03-18: A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.
CVE-2019-14882 - CVSS 6.1 (medium), 2020-03-18: A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.
CVE-2019-14881 - CVSS 6.1 (medium), 2020-03-18: A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.
CVE-2019-14879 - CVSS 5.4 (medium), 2020-01-07: A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the…
CVE-2019-3847 - CVSS 5.4 (medium), 2019-03-27: A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as…
CVE-2019-3851 - CVSS 4.3 (medium), 2019-03-26: A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning…
CVE-2019-3850 - CVSS 6.1 (medium), 2019-03-26: A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the…
CVE-2019-3849 - CVSS 8.8 (high), 2019-03-26: A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed…
CVE-2019-3852 - CVSS 4.3 (medium), 2019-03-26: A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing…
CVE-2019-3848 - CVSS 4.3 (medium), 2019-03-26: A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the…
CVE-2019-3810 - CVSS 6.1 (medium), 2019-03-25: A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not…
CVE-2019-3809 - CVSS 10 (critical), 2019-03-25: A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it…
CVE-2019-3808 - CVSS 5.4 (medium), 2019-03-25: A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability…
CVE-2018-16854 - CVSS 8.8 (high), 2018-11-26: A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent…
CVE-2018-14631 - CVSS 8.8 (high), 2018-09-17: moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation…
CVE-2018-14630 - CVSS 8.8 (high), 2018-09-17: moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing…
CVE-2018-10891 - CVSS 7.3 (high), 2018-07-10: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that…
CVE-2018-10890 - CVSS 5.3 (medium), 2018-07-10: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden…
CVE-2018-10889 - CVSS 5.3 (medium), 2018-07-10: A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other…