1.9.3 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:moodle:moodle:1.9.3:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2013-4525	79	XSS	2013-11-26	2020-12-01	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in mod/quiz/report/responses/responses_table.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via an answer to a text-based quiz question.
2	CVE-2013-4524	22	Dir. Trav.	2013-11-26	2020-12-01	6.8	None	Remote	Low	???	Complete	None	None
Directory traversal vulnerability in repository/filesystem/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to read arbitrary files via a .. (dot dot) in a path.
3	CVE-2013-4523	79	XSS	2013-11-26	2020-12-01	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in message/lib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted message.
4	CVE-2013-4522	200	+Info	2013-11-26	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
lib/filelib.php in Moodle through 2.2.11, 2.3.x before 2.3.10, 2.4.x before 2.4.7, and 2.5.x before 2.5.3 does not send "Cache-Control: private" HTTP headers, which allows remote attackers to obtain sensitive information by requesting a file that had been previously retrieved by a caching proxy server.
5	CVE-2013-3630	94		2013-11-01	2021-10-12	4.6	None	Remote	High	???	Partial	Partial	Partial
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
6	CVE-2013-1834	264		2013-03-25	2020-12-01	4.0	None	Remote	Low	???	None	Partial	None
notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.
7	CVE-2013-1831	200	+Info	2013-03-25	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
8	CVE-2013-1830	264	+Info	2013-03-25	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search.
9	CVE-2012-6098	264		2013-01-27	2020-12-01	4.0	None	Remote	Low	???	None	Partial	None
grade/edit/outcome/edit_form.php in Moodle 1.9.x through 1.9.19, 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 does not properly enforce the moodle/grade:manage capability requirement, which allows remote authenticated users to convert custom outcomes into standard site-wide outcomes by leveraging the teacher role and using the re-editing feature.
10	CVE-2012-3398		DoS	2012-07-23	2020-12-01	4.0	None	Remote	Low	???	None	None	Partial
Algorithmic complexity vulnerability in Moodle 1.9.x before 1.9.19, 2.0.x before 2.0.10, 2.1.x before 2.1.7, and 2.2.x before 2.2.4 allows remote authenticated users to cause a denial of service (CPU consumption) by using the advanced-search feature on a database activity that has many records.
11	CVE-2012-2367	264	Bypass	2012-07-21	2020-12-01	4.0	None	Remote	Low	???	None	Partial	None
Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, and 2.2.x before 2.2.3 allows remote authenticated users to bypass the moodle/calendar:manageownentries capability requirement and add a calendar entry via a New Entry action.
12	CVE-2012-2363	89	Exec Code Sql	2012-07-21	2020-12-01	6.5	None	Remote	Low	???	Partial	Partial	Partial
SQL injection vulnerability in calendar/event.php in the calendar implementation in Moodle 1.9.x before 1.9.18 allows remote authenticated users to execute arbitrary SQL commands via a crafted calendar event.
13	CVE-2012-2362	79	XSS	2012-07-21	2020-12-01	2.6	None	Remote	High	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in blog/lib.php in the blog implementation in Moodle 1.9.x before 1.9.18, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted parameter to blog/index.php.
14	CVE-2012-0796	94		2012-07-17	2020-12-01	4.0	None	Remote	Low	???	None	Partial	None
class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header.
15	CVE-2012-0795	20		2012-07-17	2020-12-01	6.5	None	Remote	Low	???	Partial	Partial	Partial
Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address.
16	CVE-2012-0794	255		2012-07-17	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's source code within the open-source software distribution.
17	CVE-2012-0793	264		2012-07-17	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors.
18	CVE-2012-0792	200	+Info	2012-07-17	2020-12-01	4.0	None	Remote	Low	???	Partial	None	None
mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts.
19	CVE-2011-4593	200	+Info	2012-07-20	2020-12-01	4.0	None	Remote	Low	???	Partial	None	None
Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle user/action_redir group messages, which allows remote authenticated users to discover e-mail addresses by visiting the messaging interface.
20	CVE-2011-4588	264	Bypass	2012-07-20	2020-12-01	5.0	None	Remote	Low	Not required	None	Partial	None
The ip_in_range function in mnet/lib.php in MNET in Moodle 1.9.x before 1.9.15 uses an incorrect data type, which allows remote attackers to bypass intended IP address restrictions via an XMLRPC request.
21	CVE-2011-4587	255		2012-07-20	2020-12-01	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
lib/moodlelib.php in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 does not properly handle certain zero values in the password policy, which makes it easier for remote attackers to obtain access by leveraging the possible existence of user accounts that have unchangeable blank passwords.
22	CVE-2011-4586		Http R.Spl.	2012-07-20	2020-12-01	5.0	None	Remote	Low	Not required	None	Partial	None
CRLF injection vulnerability in calendar/set.php in the Calendar subsystem in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
23	CVE-2011-4585	16		2012-07-20	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
login/change_password.php in Moodle 1.9.x before 1.9.15 does not use https for the change-password form even if the httpslogin option is enabled, which allows remote attackers to obtain credentials by sniffing the network.
24	CVE-2011-4584	264		2012-07-20	2020-12-01	4.0	None	Remote	Low	???	None	Partial	None
The MNET authentication functionality in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, and 2.1.x before 2.1.3 allows remote authenticated users to impersonate other user accounts by using the Login As feature in conjunction with a remote MNET single sign-on capability, as demonstrated by a Mahara site.
25	CVE-2011-4308	264		2012-07-11	2020-12-01	4.0	None	Remote	Low	???	Partial	None	None
mod/forum/user.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 allows remote authenticated users to discover the names of other users via unspecified vectors.
26	CVE-2011-4306	79	XSS	2012-07-11	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in course/editsection.html in Moodle 1.9.x before 1.9.14 allows remote authenticated users to inject arbitrary web script or HTML via crafted data.
27	CVE-2011-4305	189	DoS	2012-07-11	2020-12-01	4.0	None	Remote	Low	???	None	None	Partial
message/refresh.php in Moodle 1.9.x before 1.9.14 allows remote authenticated users to cause a denial of service (infinite request loop) via a URL that specifies a zero wait time for message refreshing.
28	CVE-2011-4302	20	Bypass	2012-07-11	2020-12-01	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
mnet/xmlrpc/client.php in MNET in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not properly process the return value of the openssl_verify function, which allows remote attackers to bypass validation via a crafted certificate.
29	CVE-2011-4301			2012-07-11	2020-12-01	5.0	None	Remote	Low	Not required	None	Partial	None
The MoodleQuickForm class in the Forms Library in lib/formslib.php in Moodle 1.9.x before 1.9.14, 2.0.x before 2.0.5, and 2.1.x before 2.1.2 does not recognize Forms API setConstant operations, which allows remote attackers to submit unexpected form content by modifying the values of constant fields.
30	CVE-2011-4294	20		2012-07-16	2020-12-01	5.8	None	Remote	Medium	Not required	None	Partial	Partial
The error-message functionality in Moodle 1.9.x before 1.9.13, 2.0.x before 2.0.4, and 2.1.x before 2.1.1 does not ensure that a continuation link refers to an http or https URL for the local Moodle instance, which might allow attackers to trick users into visiting arbitrary web sites via unspecified vectors.
31	CVE-2011-4290	79	XSS	2012-07-16	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in lib/weblib.php in Moodle 1.9.x before 1.9.12 allow remote attackers to inject arbitrary web script or HTML via vectors related to URL encoding.
32	CVE-2011-4288	264		2012-07-16	2020-12-01	4.0	None	Remote	Low	???	Partial	None	None
Moodle 1.9.x before 1.9.12 and 2.0.x before 2.0.3 does not properly implement associations between teachers and groups, which allows remote authenticated users to read quiz reports of arbitrary students by leveraging the teacher role.
33	CVE-2011-4286	79	XSS	2012-07-16	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos.
34	CVE-2011-4283	200	+Info	2012-07-16	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 places an IMS enterprise enrolment file in the course-files area, which allows remote attackers to obtain sensitive information via a request for imsenterprise-enrol.xml.
35	CVE-2011-4278	79	XSS	2012-07-16	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the tag autocomplete functionality in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
36	CVE-2011-4203	94	Http R.Spl.	2011-12-22	2020-12-01	5.0	None	Remote	Low	Not required	None	Partial	None
CRLF injection vulnerability in calendar/set.php in the Calendar component in Moodle 1.9.x before 1.9.15, 2.0.x before 2.0.6, 2.1.x before 2.1.3, and 2.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors involving the url variable.
37	CVE-2011-4133	352	CSRF	2012-07-16	2020-12-01	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in Moodle 1.9.x before 1.9.11 allows remote attackers to hijack the authentication of unspecified victims for requests that modify an RSS feed in an RSS block.
38	CVE-2010-2231	352	CSRF	2010-06-28	2020-12-01	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in report/overview/report.php in the quiz module in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to hijack the authentication of arbitrary users for requests that delete quiz attempts via the attemptid parameter.
39	CVE-2010-2230	79	XSS	2010-06-28	2020-12-01	4.0	None	Remote	Low	???	None	Partial	None
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
40	CVE-2010-2229	79	XSS	2010-06-28	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in blog/index.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
41	CVE-2010-2228	79	XSS	2010-06-28	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the MNET access-control interface in Moodle before 1.8.13 and 1.9.x before 1.9.9 allows remote attackers to inject arbitrary web script or HTML via vectors involving extended characters in a username.
42	CVE-2010-1619	79	XSS	2010-04-29	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the fix_non_standard_entities function in the KSES HTML text cleaning library (weblib.php), as used in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8, allows remote attackers to inject arbitrary web script or HTML via crafted HTML entities.
43	CVE-2010-1617	264		2010-04-29	2020-12-01	4.0	None	Remote	Low	???	Partial	None	None
user/view.php in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 does not properly check a role, which allows remote authenticated users to obtain the full names of other users via the course profile page.
44	CVE-2010-1616			2010-04-29	2020-12-01	4.0	None	Remote	Low	???	None	Partial	None
Moodle 1.8.x and 1.9.x before 1.9.8 can create new roles when restoring a course, which allows teachers to create new accounts even if they do not have the moodle/user:create capability.
45	CVE-2010-1615	89	Exec Code Sql	2010-04-29	2020-12-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple SQL injection vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) the add_to_log function in mod/wiki/view.php in the wiki module, or (2) "data validation in some forms elements" related to lib/form/selectgroups.php.
46	CVE-2010-1614	79	XSS CSRF	2010-04-29	2020-12-01	4.3	None	Remote	Medium	Not required	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Moodle 1.8.x before 1.8.12 and 1.9.x before 1.9.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the Login-As feature or (2) when the global search feature is enabled, unspecified global search forms in the Global Search Engine. NOTE: vector 1 might be resultant from a cross-site request forgery (CSRF) vulnerability.
47	CVE-2010-1613	287		2010-04-29	2020-12-01	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Moodle 1.8.x and 1.9.x before 1.9.8 does not enable the "Regenerate session id during login" setting by default, which makes it easier for remote attackers to conduct session fixation attacks.
48	CVE-2009-4305	89	Exec Code Sql	2009-12-16	2020-12-01	6.5	None	Remote	Low	???	Partial	Partial	Partial
SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an "escaping issue when processing AICC CRS file (Course_Title)."
49	CVE-2009-4304	255		2009-12-16	2020-12-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks.
50	CVE-2009-4303	200	+Info	2009-12-16	2020-12-01	5.0	None	Remote	Low	Not required	Partial	None	None
Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information.

Total number of vulnerabilities : 60 Page : 1 (This Page)2