Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6649
Adobe 6383
Ibm 6266
Cisco 5746
Debian 3919
Apache 2864
Mozilla 2857
Redhat 2581
Moodle
HIGH 8.8
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.
Moodle
HIGH 7.5
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCA…
Moodle
MEDIUM 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedba…
Moodle
MEDIUM 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki m…
Moodle
MEDIUM 6.5
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore databa…
Moodle
MEDIUM 5.9
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore worksh…
Moodle
HIGH 8.4
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.
Moodle
CRITICAL 9.8
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
Moodle
MEDIUM 6.2
Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did …
Moodle
MEDIUM 6.1
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.
Moodle
MEDIUM 5.4
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
Moodle
MEDIUM 5.4
The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a per…
Moodle
MEDIUM 6.1
A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.
Moodle
HIGH 8.8
The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.
Moodle
MEDIUM 5.3
Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only prov…
Moodle
MEDIUM 5.3
Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only…
Moodle
MEDIUM 5.3
Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise ava…
Moodle
HIGH 7.5
Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.
Moodle
MEDIUM 5.3
The URL parameters accepted by forum search were not limited to the allowed parameters.
Moodle
CRITICAL 9.8
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the …
Moodle
MEDIUM 6.1
The course upload preview contained an XSS risk for users uploading unsafe data.
Moodle
MEDIUM 5.4
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
Moodle
MEDIUM 5.3
Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.
Moodle
MEDIUM 5.3
Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not hav…
Moodle
HIGH 8.8
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.
Moodle
MEDIUM 6.1
The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content.
Moodle
MEDIUM 5.4
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
Moodle
MEDIUM 5.3
H5P metadata automatically populated the author with the user's username, which could be sensitive information.
Moodle
HIGH 8.8
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.
Moodle
MEDIUM 5.4
Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "S…