Vulnerabilities > Moodle > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2017-03-29 | CVE-2017-7298 | Cross-site Scripting vulnerability in Moodle 3.2.2 In Moodle 3.2.2+, there is XSS in the Course summary filter of the "Add a new course" page, as demonstrated by a crafted attribute of an SVG element. | 5.4 |
| 2017-03-26 | CVE-2017-2645 | Cross-site Scripting vulnerability in Moodle In Moodle 3.x, XSS can occur via attachments to evidence of prior learning. | 6.1 |
| 2017-03-26 | CVE-2017-2644 | Cross-site Scripting vulnerability in Moodle In Moodle 3.x, XSS can occur via evidence of prior learning. | 6.1 |
| 2017-03-26 | CVE-2017-2643 | Information Exposure vulnerability in Moodle 3.2.0/3.2.1 In Moodle 3.2.x, global search displays user names for unauthenticated users. | 5.3 |
| 2017-01-20 | CVE-2017-2578 | Cross-site Scripting vulnerability in Moodle In Moodle 3.x, there is XSS in the assignment submission page. | 6.1 |
| 2017-01-20 | CVE-2017-2576 | Improper Input Validation vulnerability in Moodle In Moodle 2.x and 3.x, there is incorrect sanitization of attributes in forums. | 5.3 |
| 2017-01-20 | CVE-2016-8644 | Permissions, Privileges, and Access Controls vulnerability in Moodle In Moodle 2.x and 3.x, the capability to view course notes is checked in the wrong context. | 5.3 |
| 2017-01-20 | CVE-2016-8643 | Improper Access Control vulnerability in Moodle In Moodle 2.x and 3.x, non-admin site managers may accidentally edit admins via web services. | 4.3 |
| 2017-01-20 | CVE-2016-8642 | Improper Access Control vulnerability in Moodle In Moodle 2.x and 3.x, the question engine allows access to files that should not be available. | 5.3 |
| 2017-01-20 | CVE-2016-5014 | Information Exposure vulnerability in Moodle In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course. | 5.4 |