Your submission was sent successfully! Close

You have successfully unsubscribed! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates about Ubuntu and upcoming events where you can meet our team.Close

Search CVE reports


Toggle filters

1 – 10 of 583 results


CVE-2024-43440

Medium priority
Needs evaluation

[Unknown description]

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-37674

Medium priority
Needs evaluation

Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field Name (name parameter) of a new activity.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-38277

Medium priority
Not affected

A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between the two.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Not affected Not affected
Show less packages

CVE-2024-38276

Medium priority
Needs evaluation

Incorrect CSRF token checks resulted in multiple CSRF risks.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-38275

Medium priority
Needs evaluation

The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-38274

Medium priority
Needs evaluation

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-38273

Medium priority
Needs evaluation

Insufficient capability checks meant it was possible for users to gain access to BigBlueButton join URLs they did not have permission to access.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-34009

Medium priority
Needs evaluation

Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-34008

Medium priority
Needs evaluation

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages

CVE-2024-34007

Medium priority
Needs evaluation

The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.

1 affected packages

moodle

Package 24.04 LTS 22.04 LTS 20.04 LTS 18.04 LTS 16.04 LTS
moodle Not in release Not in release Not in release Needs evaluation Needs evaluation
Show less packages