Search for packages
| purl | pkg:composer/moodle/moodle@3.2.6 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-ajkr-fxa1-mkhk
Aliases: CVE-2018-1045 |
Cross-site Scripting Moodle is vulnerable to XSS via a calendar event name. |
Affected by 1 other vulnerability. Affected by 2 other vulnerabilities. |
|
VCID-duna-st9c-mqbk
Aliases: CVE-2018-1044 |
Information Exposure In Moodle, the quiz web services allow students to see quiz results when it is prohibited in the settings. |
Affected by 1 other vulnerability. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-nc2j-pay7-ryab
Aliases: CVE-2018-1043 |
Insufficient Access Control The setting for blocked hosts list can be bypassed with multiple A record `hostnames`. |
Affected by 1 other vulnerability. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
|
VCID-yghg-775s-vber
Aliases: CVE-2018-1042 |
Server-Side Request Forgery (SSRF) Moodle has Server Side Request Forgery in the `filepicker`. |
Affected by 1 other vulnerability. Affected by 2 other vulnerabilities. Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-83kb-4mk9-t7ge | Information Exposure Students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This allows enumerating and guessing emails of other students. |
CVE-2017-15110
|
| VCID-zgzm-wj81-jkah | Cross-site Scripting Moodle has an XSS in the contact form on the "non-respondents" page in non-anonymous feedback. |
CVE-2017-12156
|