Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

moodle moodle 2.7.10 vulnerabilities and exploits

(subscribe to this query)
4.3
CVSSv3
CVE-2015-5335
Cross-site request forgery (CSRF) vulnerability in admin/registration/register.php in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 allows remote malicious users to hijack the authentication of administrators for requests...
Moodle Moodle 2.8.4Moodle Moodle 2.8.3Moodle Moodle 2.8.2Moodle Moodle 2.8.1Moodle Moodle 2.9.2Moodle Moodle 2.9.1Moodle Moodle 2.9.0Moodle Moodle 2.7.5Moodle Moodle 2.7.4Moodle Moodle 2.7.3Moodle Moodle 2.7.2Moodle Moodle 2.8.8Moodle Moodle 2.8.6Moodle Moodle 2.7.9Moodle Moodle 2.7.7Moodle Moodle 2.7.1Moodle MoodleMoodle Moodle 2.8.7Moodle Moodle 2.8.5Moodle Moodle 2.8.0Moodle Moodle 2.7.8Moodle Moodle 2.7.6
5.4
CVSSv3
CVE-2015-5336
Multiple cross-site scripting (XSS) vulnerabilities in the survey module in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the student r...
Moodle Moodle 2.8.0Moodle Moodle 2.7.9Moodle Moodle 2.7.8Moodle Moodle 2.7.7Moodle Moodle 2.9.1Moodle Moodle 2.9.0Moodle Moodle 2.8.7Moodle Moodle 2.8.6Moodle Moodle 2.8.5Moodle Moodle 2.7.2Moodle Moodle 2.7.1Moodle Moodle 2.7.0Moodle MoodleMoodle Moodle 2.8.8Moodle Moodle 2.8.4Moodle Moodle 2.8.2Moodle Moodle 2.7.5Moodle Moodle 2.7.3Moodle Moodle 2.7.10Moodle Moodle 2.9.2Moodle Moodle 2.8.3Moodle Moodle 2.8.1
6.1
CVSSv3
CVE-2015-5337
Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote malicious users to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
Moodle Moodle 2.8.8Moodle Moodle 2.8.7Moodle Moodle 2.8.6Moodle Moodle 2.8.5Moodle Moodle 2.8.4Moodle Moodle 2.7.10Moodle Moodle 2.7.1Moodle Moodle 2.7.0Moodle MoodleMoodle Moodle 2.7.9Moodle Moodle 2.7.8Moodle Moodle 2.7.7Moodle Moodle 2.7.6Moodle Moodle 2.9.1Moodle Moodle 2.8.3Moodle Moodle 2.8.1Moodle Moodle 2.7.4Moodle Moodle 2.7.2Moodle Moodle 2.9.2Moodle Moodle 2.9.0Moodle Moodle 2.8.2Moodle Moodle 2.8.0
8.8
CVSSv3
CVE-2015-5338
Multiple cross-site request forgery (CSRF) vulnerabilities in the lesson module in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 allow remote malicious users to hijack the authentication of arbitrary users for requests to...
Moodle Moodle 2.7.9Moodle Moodle 2.7.8Moodle Moodle 2.7.7Moodle Moodle 2.7.6Moodle Moodle 2.8.7Moodle Moodle 2.8.6Moodle Moodle 2.8.5Moodle Moodle 2.8.4Moodle Moodle 2.7.10Moodle Moodle 2.7.1Moodle Moodle 2.7.0Moodle MoodleMoodle Moodle 2.9.1Moodle Moodle 2.8.8Moodle Moodle 2.8.3Moodle Moodle 2.8.1Moodle Moodle 2.7.4Moodle Moodle 2.7.2Moodle Moodle 2.9.2Moodle Moodle 2.9.0Moodle Moodle 2.8.2Moodle Moodle 2.8.0
4.3
CVSSv3
CVE-2015-5339
The core_enrol_get_enrolled_users web service in enrol/externallib.php in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 does not properly implement group-based access restrictions, which allows remote authenticated users ...
Moodle Moodle 2.9.0Moodle Moodle 2.8.7Moodle Moodle 2.8.6Moodle Moodle 2.8.5Moodle Moodle 2.7.2Moodle Moodle 2.7.1Moodle Moodle 2.7.0Moodle MoodleMoodle Moodle 2.8.0Moodle Moodle 2.7.9Moodle Moodle 2.7.8Moodle Moodle 2.7.7Moodle Moodle 2.8.8Moodle Moodle 2.9.1Moodle Moodle 2.8.4Moodle Moodle 2.8.2Moodle Moodle 2.7.5Moodle Moodle 2.7.3Moodle Moodle 2.7.10Moodle Moodle 2.9.2Moodle Moodle 2.8.3Moodle Moodle 2.8.1
4.3
CVSSv3
CVE-2015-5340
Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) badges/ove...
Moodle Moodle 2.8.2Moodle Moodle 2.8.1Moodle Moodle 2.8.0Moodle Moodle 2.7.9Moodle Moodle 2.9.1Moodle Moodle 2.9.0Moodle Moodle 2.8.8Moodle Moodle 2.8.7Moodle Moodle 2.7.4Moodle Moodle 2.7.3Moodle Moodle 2.7.2Moodle Moodle 2.7.10Moodle Moodle 2.7.1Moodle Moodle 2.9.2Moodle Moodle 2.8.6Moodle Moodle 2.8.4Moodle Moodle 2.7.7Moodle Moodle 2.7.5Moodle MoodleMoodle Moodle 2.8.5Moodle Moodle 2.8.3Moodle Moodle 2.7.8
4.3
CVSSv3
CVE-2015-5341
mod_scorm in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 mishandles availability dates, which allows remote authenticated users to bypass intended access restrictions and read SCORM contents via unspecified vectors.
Moodle Moodle 2.9.1Moodle Moodle 2.9.0Moodle Moodle 2.8.8Moodle Moodle 2.8.7Moodle Moodle 2.7.3Moodle Moodle 2.7.2Moodle Moodle 2.7.10Moodle Moodle 2.7.1Moodle Moodle 2.8.2Moodle Moodle 2.8.1Moodle Moodle 2.8.0Moodle Moodle 2.7.9Moodle Moodle 2.9.2Moodle Moodle 2.8.6Moodle Moodle 2.8.4Moodle Moodle 2.7.7Moodle Moodle 2.7.5Moodle MoodleMoodle Moodle 2.8.5Moodle Moodle 2.8.3Moodle Moodle 2.7.8Moodle Moodle 2.7.6
4.3
CVSSv3
CVE-2015-5342
The choice module in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.11, 2.8.x prior to 2.8.9, and 2.9.x prior to 2.9.3 allows remote authenticated users to bypass intended access restrictions by visiting a URL to add or delete responses in the closed state.
Moodle Moodle 2.7.10Moodle Moodle 2.8.8Moodle Moodle 2.9.2Moodle Moodle 2.7.6Moodle Moodle 2.7.5Moodle Moodle 2.7.4Moodle Moodle 2.7.3Moodle Moodle 2.8.5Moodle Moodle 2.8.4Moodle Moodle 2.8.3Moodle Moodle 2.8.2Moodle Moodle 2.8.1Moodle Moodle 2.9.1Moodle Moodle 2.8.7Moodle Moodle 2.8.0Moodle Moodle 2.7.8Moodle Moodle 2.7.1Moodle MoodleMoodle Moodle 2.9.0Moodle Moodle 2.8.6Moodle Moodle 2.7.9Moodle Moodle 2.7.7
4.3
CVSSv3
CVE-2016-0724
The (1) core_enrol_get_course_enrolment_methods and (2) enrol_self_get_instance_info web services in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.12, 2.8.x prior to 2.8.10, 2.9.x prior to 2.9.4, and 3.0.x prior to 3.0.2 do not consider the moodle/course:viewhiddencourses...
Moodle Moodle 2.7.10Moodle Moodle 2.8.9Moodle Moodle 2.8.6Moodle Moodle 2.8.5Moodle Moodle 2.7.8Moodle Moodle 2.7.7Moodle Moodle 2.7.6Moodle MoodleMoodle Moodle 3.0.0Moodle Moodle 2.7.11Moodle Moodle 2.9.0Moodle Moodle 2.8.7Moodle Moodle 2.8.0Moodle Moodle 2.7.9Moodle Moodle 2.7.1Moodle Moodle 2.7.0Moodle Moodle 3.0.1Moodle Moodle 2.9.2Moodle Moodle 2.9.1Moodle Moodle 2.8.2Moodle Moodle 2.8.1Moodle Moodle 2.7.3
4.3
CVSSv3
CVE-2016-2151
user/index.php in Moodle up to and including 2.6.11, 2.7.x prior to 2.7.13, 2.8.x prior to 2.8.11, 2.9.x prior to 2.9.5, and 3.0.x prior to 3.0.3 grants excessive authorization on the basis of the moodle/course:viewhiddenuserfields capability, which allows remote authenticated us...
Moodle Moodle 3.0.1Moodle Moodle 3.0.0Moodle Moodle 2.8.9Moodle Moodle 2.8.8Moodle Moodle 2.8.0Moodle Moodle 2.7.12Moodle Moodle 2.7.5Moodle Moodle 2.7.4Moodle Moodle 3.0.2Moodle Moodle 2.9.0Moodle Moodle 2.8.10Moodle Moodle 2.8.3Moodle Moodle 2.8.2Moodle Moodle 2.8.1Moodle Moodle 2.7.7Moodle Moodle 2.7.6Moodle MoodleMoodle Moodle 2.9.2Moodle Moodle 2.9.1Moodle Moodle 2.8.5Moodle Moodle 2.8.4Moodle Moodle 2.7.9
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2006-4304CVE-2024-4240arbitrary CVE-2024-31601XSSCVE-2023-20198CVE-2024-4256CVE-2024-3342encryption
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook