Updated 7 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

663 results · page 6 of 14

Dec 7, 2020A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site adminiCVE-2020-25629 · Other software · Moodle · reported by Red HatHigh 8.8
A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. This is fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record moodle.org moodle.org
Dec 7, 2020The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk.CVE-2020-25628 · Other software · Moodle · reported by Red HatMedium 6.1
The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org moodle.org
Nov 19, 2020The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden.CVE-2020-25703 · Other software · Moodle · reported by Red HatMedium 5.3
The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.fedoraproject.org
Nov 19, 2020In Moodle, it was possible to include JavaScript when re-naming content bank items.CVE-2020-25702 · Other software · Moodle · reported by Red HatMedium 6.1
In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.fedoraproject.org
Nov 19, 2020If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable thCVE-2020-25701 · Other software · Moodle · reported by Red HatMedium 5.3
If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.fedoraproject.org
Nov 19, 2020In moodle, some database module web services allowed students to add entries within groups they did not belong to.CVE-2020-25700 · Other software · Moodle · reported by Red HatMedium 6.5
In moodle, some database module web services allowed students to add entries within groups they did not belong to. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.8.6, 3.7.9, 3.5.15, and 3.10.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.fedoraproject.org
Nov 19, 2020In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course.CVE-2020-25699 · Other software · Moodle · reported by Red HatHigh 7.5
In moodle, insufficient capability checks could lead to users with the ability to course restore adding additional capabilities to roles within that course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.fedoraproject.org
Nov 19, 2020Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course.CVE-2020-25698 · Other software · Moodle · reported by Red HatHigh 7.5
Users' enrollment capabilities were not being sufficiently checked in Moodle when they are restored into an existing course. This could lead to them unenrolling users without having permission to do so. Versions affected: 3.5 to 3.5.14, 3.7 to 3.7.8, 3.8 to 3.8.5, 3.9 to 3.9.2 and earlier unsupported versions. Fixed in 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com lists.fedoraproject.org
May 21, 2020A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions.CVE-2020-10738 · Other software · [UNKNOWN] · reported by Red HatHigh 7.5
A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org bugzilla.redhat.com
Mar 31, 2020A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier.CVE-2019-14880 · Other software · [UNKNOWN] · reported by Red HatCritical 9.1
A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 18, 2020A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.CVE-2019-14884 · Other software · [UNKNOWN] · reported by Red HatMedium 6.1
A vulnerability was found in Moodle 3.7 before 3.73, 3.6 before 3.6.7 and 3.5 before 3.5.9, where a reflected XSS possible from some fatal error messages.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 18, 2020A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabledCVE-2019-14883 · Other software · [UNKNOWN] · reported by Red HatMedium 5.3
A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 18, 2020A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.CVE-2019-14882 · Other software · [UNKNOWN] · reported by Red HatMedium 6.1
A vulnerability was found in Moodle 3.7 to 3.7.3, 3.6 to 3.6.7, 3.5 to 3.5.9 and earlier where an open redirect existed in the Lesson edit page.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 18, 2020A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.CVE-2019-14881 · Other software · [UNKNOWN] · reported by Red HatMedium 6.1
A vulnerability was found in moodle 3.7 before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Feb 17, 2020Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.CVE-2020-1692 · Other software · The Moodle Project · reported by Red HatHigh 8.1
Moodle before version 3.7.2 is vulnerable to information exposure of service tokens for users enrolled in the same course.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Feb 11, 2020Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another usCVE-2019-18210 · Other software · Moodle · reported by MITREMedium 5.4
Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation, they have stated "this report has been closed as a false positive, and not a bug."
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.moodle.org gist.github.com
Jan 7, 2020A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9.CVE-2019-14879 · Other software · [UNKNOWN] · reported by Red HatMedium 5.4
A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com bugzilla.redhat.com
Nov 14, 2019Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thoroughCVE-2012-1170 · Other software · Moodle · reported by Red HatHigh 7.5
Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page bCVE-2012-1169 · Other software · Moodle · reported by Red HatMedium 5.3
Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search resultsCVE-2012-1161 · Other software · Moodle · reported by Red HatMedium 4.3
Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.phpCVE-2012-1160 · Other software · Moodle · reported by Red HatLow 2.7
Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2: Overview report allows users to see hidden coursesCVE-2012-1159 · Other software · Moodle · reported by Red HatMedium 4.3
Moodle before 2.2.2: Overview report allows users to see hidden courses
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in exportCVE-2012-1158 · Other software · Moodle · reported by Red HatMedium 4.3
Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by defaultCVE-2012-1157 · Other software · Moodle · reported by Red HatMedium 4.3
Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified.CVE-2012-1168 · Other software · Moodle · reported by Red HatHigh 8.2
Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle before 2.2.2 has users' private files included in course backupsCVE-2012-1156 · Other software · Moodle · reported by Red HatHigh 7.5
Moodle before 2.2.2 has users' private files included in course backups
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Nov 14, 2019Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the CVE-2012-1155 · Other software · Moodle · reported by Red HatHigh 7.5
Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.fedoraproject.org lists.fedoraproject.org
Aug 23, 2019The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.CVE-2019-15536 · Other software · Youracclaim · reported by MITRECritical 9.8
The Acclaim block plugin before 2019-06-26 for Moodle allows SQL Injection via delete_records.
Product
Acclaim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 31, 2019A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.CVE-2019-10189 · Other software · The Moodle Project · reported by Red HatMedium 4.3
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in an assignment group could modify group overrides for other groups in the same assignment.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Jul 31, 2019A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.CVE-2019-10188 · Other software · The Moodle Project · reported by Red HatMedium 4.3
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Teachers in a quiz group could modify group overrides for other groups in the same quiz.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Jul 31, 2019A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.CVE-2019-10187 · Other software · The Moodle Project · reported by Red HatMedium 4.3
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. Users with permission to delete entries from a glossary were able to delete entries from other glossaries they did not have direct access to.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Jul 31, 2019A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.CVE-2019-10186 · Other software · The Moodle Project · reported by Red HatHigh 8.8
A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Jun 26, 2019A flaw was found in Moodle before versions 3.7, 3.6.4.CVE-2019-10154 · Other software · Moodle · reported by Red HatHigh 7.5
A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversations.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Jun 26, 2019A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18.CVE-2019-10134 · Other software · Moodle · reported by Red HatLow 3.7
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The size of users' private file uploads via email were not correctly checked, so their quota allowance could be exceeded.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Jun 26, 2019A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18.CVE-2019-10133 · Other software · Moodle · reported by Red HatLow 3.1
A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 27, 2019A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17.CVE-2019-3847 · Other software · [UNKNOWN] · reported by Red HatMedium 4.8
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Mar 26, 2019A vulnerability was found in moodle before version 3.6.3.CVE-2019-3852 · Other software · [UNKNOWN] · reported by Red HatMedium 4.3
A vulnerability was found in moodle before version 3.6.3. The get_with_capability_join and get_users_by_capability functions were not taking context freezing into account when checking user capabilities
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 26, 2019A vulnerability was found in moodle before versions 3.6.3 and 3.5.5.CVE-2019-3851 · Other software · [UNKNOWN] · reported by Red HatMedium 4.3
A vulnerability was found in moodle before versions 3.6.3 and 3.5.5. There was a link to site home within the the Boost theme's secure layout, meaning students could navigate out of the page.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 26, 2019A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17.CVE-2019-3850 · Other software · [UNKNOWN] · reported by Red HatMedium 4.3
A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Links within assignment submission comments would open directly (in the same window). Although links themselves may be valid, opening within the same window and without the no-referrer header policy made them more susceptible to exploits.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 26, 2019A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8.CVE-2019-3849 · Other software · [UNKNOWN] · reported by Red HatHigh 8.8
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Users could assign themselves an escalated role within courses or content accessed via LTI, by modifying the request to the LTI publisher site.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 26, 2019A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8.CVE-2019-3848 · Other software · [UNKNOWN] · reported by Red HatMedium 4.3
A vulnerability was found in moodle before versions 3.6.3, 3.5.5 and 3.4.8. Permissions were not correctly checked before loading event information into the calendar's edit event modal popup, so logged in non-guest users could view unauthorised calendar events. (Note: It was read-only access, users could not edit the events.)
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record bugzilla.redhat.com moodle.org
Mar 25, 2019A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions.CVE-2019-3810 · Other software · [UNKNOWN] · reported by Red HatMedium 6.1
A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org packetstormsecurity.com
Mar 25, 2019A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions.CVE-2019-3809 · Other software · [UNKNOWN] · reported by Red HatMedium 6.5
A flaw was found in Moodle versions 3.1 to 3.1.15 and earlier unsupported versions. The mybackpack functionality allowed setting the URL of badges, when it should be restricted to the Mozilla Open Badges backpack URL. This resulted in the possibility of blind SSRF via requests made by the page.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org bugzilla.redhat.com
Mar 25, 2019A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions.CVE-2019-3808 · Other software · [UNKNOWN] · reported by Red HatMedium 5.4
A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org bugzilla.redhat.com
Mar 21, 2019Moodle 3.5.x before 3.5.4 allows SSRF.CVE-2019-6970 · Other software · Moodle · reported by MITREHigh 7.5
Moodle 3.5.x before 3.5.4 allows SSRF.
Product
Moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cds.thalesgroup.com excellium-services.com
Nov 26, 2018A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier.CVE-2018-16854 · Other software · [UNKNOWN] · reported by Red HatMedium 6.5
A flaw was found in moodle versions 3.5 to 3.5.2, 3.4 to 3.4.5, 3.3 to 3.3.8, 3.1 to 3.1.14 and earlier. The login form is not protected by a token to prevent login cross-site request forgery. Fixed versions include 3.6, 3.5.3, 3.4.6, 3.3.9 and 3.1.15.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org securityfocus.com
Sep 17, 2018moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered.CVE-2018-14631 · Other software · [UNKNOWN] · reported by Red HatHigh 8.8
moodle before versions 3.5.2, 3.4.5, 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered, which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org securityfocus.com
Sep 17, 2018moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution.CVE-2018-14630 · Other software · [UNKNOWN] · reported by Red HatHigh 8.8
moodle before versions 3.5.2, 3.4.5, 3.3.8, 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions, it was possible to inject and execute PHP code from within the imported questions, either intentionally or by importing questions from an untrusted source.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record git.moodle.org securityfocus.com
Jul 10, 2018A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13.CVE-2018-10891 · Other software · [UNKNOWN] · reported by Red HatHigh 7.3
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com
Jul 10, 2018A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13.CVE-2018-10890 · Other software · [UNKNOWN] · reported by Red HatMedium 4.3
A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to return hidden categories, which should be omitted when fetching course categories.
Product
moodle
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com bugzilla.redhat.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.