Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Moodle
MEDIUM 6.1
The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.
Moodle
MEDIUM 6.1
Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.
Moodle
MEDIUM 6.1
The question bank filter required additional sanitizing to prevent a reflected XSS risk.
Moodle
MEDIUM 5.3
Tags not expected to be visible to a user could still be discovered by them via the tag search page or in the tags block.
Moodle
MEDIUM 5.3
Insufficient capability checks made it possible to disable badges a user does not have permission to access.
Moodle
HIGH 7.5
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.
Moodle
MEDIUM 6.5
A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they…
Moodle
MEDIUM 5.4
A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a…
Moodle
MEDIUM 6.1
A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.
Moodle
MEDIUM 6.1
A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from maliciou…
Moodle
MEDIUM 5.3
A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.
Moodle
MEDIUM 5.3
A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original requ…
Moodle
MEDIUM 5.3
A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.
Moodle
MEDIUM 5.3
A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them in…
Moodle
MEDIUM 5.3
A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden us…
Moodle
HIGH 8.1
The bulk message sending feature in Moodle's Feedback module's non-respondents report had an incorrect CSRF token check, leading to a CSRF vulnerabil…
Moodle
HIGH 7.5
A flaw was found in Feedback. Bulk messaging in the activity's non-respondents report did not verify message recipients belonging to the set of users…
Moodle
HIGH 7.5
A flaw was found in moodle. A local file may include risks when restoring block backups.
Moodle
HIGH 7.2
A SQL injection risk flaw was found in the XMLDB editor tool available to site administrators.
Moodle
HIGH 8.1
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requi…
Moodle
HIGH 7.5
A flaw was found in pdfTeX. Insufficient sanitizing in the TeX notation filter resulted in an arbitrary file read risk on sites where pdfTeX is avail…
Moodle
HIGH 7.5
A vulnerability was found in Moodle. Insufficient capability checks made it possible to delete badges that a user does not have permission to access.
Moodle
HIGH 7.1
To address a cache poisoning risk in Moodle, additional validation for local storage was required.
Virtual Programming Lab
MEDIUM 6.1
Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js.
Moodle
MEDIUM 5.5
Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a ne…
Moodle
MEDIUM 5.4
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
Moodle
HIGH 7.5
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintent…
Moodle
MEDIUM 6.1
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
Moodle
MEDIUM 5.4
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
Moodle
HIGH 8.8
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.