Moodle
by Moodle
Source repositories
CVEs (570)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-34312 | 0.00 | — | 0.01 | Jun 24, 2024 | Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js. | |||
| CVE-2024-37674 | 0.00 | — | 0.01 | Jun 20, 2024 | Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity. | |||
| CVE-2024-38277 | 0.00 | — | 0.00 | Jun 18, 2024 | A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two. | |||
| CVE-2024-38276 | 0.00 | — | 0.00 | Jun 18, 2024 | Incorrect CSRF token checks resulted in multiple CSRF risks. | |||
| CVE-2024-38275 | 0.00 | — | 0.00 | Jun 18, 2024 | The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs. | |||
| CVE-2024-38274 | 0.00 | — | 0.00 | Jun 18, 2024 | Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt. | |||
| CVE-2024-38273 | 0.00 | — | 0.00 | Jun 18, 2024 | Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access. | |||
| CVE-2024-34009 | 0.00 | — | 0.00 | May 31, 2024 | Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized. | |||
| CVE-2024-34008 | 0.00 | — | 0.00 | May 31, 2024 | Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk. | |||
| CVE-2024-34007 | 0.00 | — | 0.00 | May 31, 2024 | The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF. | |||
| CVE-2024-34006 | 0.00 | — | 0.00 | May 31, 2024 | The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered. | |||
| CVE-2024-34005 | 0.00 | — | 0.00 | May 31, 2024 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include. | |||
| CVE-2024-34004 | 0.00 | — | 0.00 | May 31, 2024 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include. | |||
| CVE-2024-34003 | 0.00 | — | 0.00 | May 31, 2024 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include. | |||
| CVE-2024-34002 | 0.00 | — | 0.00 | May 31, 2024 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include. | |||
| CVE-2024-34001 | 0.00 | — | 0.00 | May 31, 2024 | Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk. | |||
| CVE-2024-34000 | 0.00 | — | 0.00 | May 31, 2024 | ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. | |||
| CVE-2024-33999 | 0.00 | — | 0.01 | May 31, 2024 | The referrer URL used by MFA required additional sanitizing, rather than being used directly. | |||
| CVE-2024-33998 | 0.00 | — | 0.00 | May 31, 2024 | Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. | |||
| CVE-2024-33997 | 0.00 | — | 0.00 | May 31, 2024 | Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation. |
- CVE-2024-34312Jun 24, 2024risk 0.00cvss —epss 0.01
Virtual Programming Lab for Moodle up to v4.2.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component vplide.js.
- CVE-2024-37674Jun 20, 2024risk 0.00cvss —epss 0.01
Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.
- CVE-2024-38277Jun 18, 2024risk 0.00cvss —epss 0.00
A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.
- CVE-2024-38276Jun 18, 2024risk 0.00cvss —epss 0.00
Incorrect CSRF token checks resulted in multiple CSRF risks.
- CVE-2024-38275Jun 18, 2024risk 0.00cvss —epss 0.00
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.
- CVE-2024-38274Jun 18, 2024risk 0.00cvss —epss 0.00
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.
- CVE-2024-38273Jun 18, 2024risk 0.00cvss —epss 0.00
Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.
- CVE-2024-34009May 31, 2024risk 0.00cvss —epss 0.00
Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.
- CVE-2024-34008May 31, 2024risk 0.00cvss —epss 0.00
Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.
- CVE-2024-34007May 31, 2024risk 0.00cvss —epss 0.00
The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.
- CVE-2024-34006May 31, 2024risk 0.00cvss —epss 0.00
The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.
- CVE-2024-34005May 31, 2024risk 0.00cvss —epss 0.00
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- CVE-2024-34004May 31, 2024risk 0.00cvss —epss 0.00
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- CVE-2024-34003May 31, 2024risk 0.00cvss —epss 0.00
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- CVE-2024-34002May 31, 2024risk 0.00cvss —epss 0.00
In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.
- CVE-2024-34001May 31, 2024risk 0.00cvss —epss 0.00
Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.
- CVE-2024-34000May 31, 2024risk 0.00cvss —epss 0.00
ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.
- CVE-2024-33999May 31, 2024risk 0.00cvss —epss 0.01
The referrer URL used by MFA required additional sanitizing, rather than being used directly.
- CVE-2024-33998May 31, 2024risk 0.00cvss —epss 0.00
Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.
- CVE-2024-33997May 31, 2024risk 0.00cvss —epss 0.00
Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.
Page 9 of 29