Search CVE reports

In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students could search email addresses of all participants regardless of email visibility. This...

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.

In Moodle 3.x, course creators are able to change system default settings for courses.

In Moodle 3.3, the course overview block reveals activities in hidden courses.

Moodle 3.x has user fullname disclosure on the user preferences page.

In Moodle 2.x and 3.x, a CSRF attack is possible that allows attackers to change the "number of courses displayed in the course overview block" configuration setting.

In Moodle 2.x and 3.x, searching of arbitrary blogs is possible because a capability check is missing.

In Moodle 2.x and 3.x, remote authenticated users can take ownership of arbitrary blogs by editing an external blog link.

Cross-site request forgery (CSRF) vulnerability in markposts.php in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13 and earlier allows remote attackers to hijack the authentication of users for...