Hugh Davenport

An issue was discovered where an invalid multibyte string supplied as an argument to the `mb split()` function can cause PHP to execute `memcpy()` with a negative argument. This could result in reading and writing past buffers allocated for the data.

The issue allows a site admin or institution admin to inject HTML and Javascript into an institution display name. This malicious content will be displayed to other users unescaped on certain system pages, potentially leading to security issues.

The issue arises from Mahara's improper implementation of one of the MNet SSO API functions, causing users to remain logged in to their Mahara account even after being logged out of Moodle when using MNet.

The issue is related to the XPC Services API in LaunchServices, which has inadequate access control. This allows an attacker to bypass event-handler restrictions and modify events of arbitrary apps using a crafted app. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to insufficient access control to certain links, allowing a remote attacker to obtain sensitive URL information by reading a Referer log. This could potentially lead to unauthorized access to protected information.

The issue exists due to the lack of protection for the web page structure in the survey module of the Moodle learning management system. This allows a remote attacker, using the `student` role and a specially crafted survey answer, to inject arbitrary web or HTML code.

The issue is related to the xmlSAX2TextNode function in the HTML parser of libxml2, which allows context-dependent attackers to cause a denial of service or obtain sensitive information via crafted XML data. This can lead to a stack-based buffer over-read and application crash. The vulnerability can be exploited by a remote attacker using specially formed XML data.

The issue allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted gradebook feedback during manual quiz grading, due to the failure to set the RISK XSS bit for graders in the mod/quiz/db/access.php file. This can be exploited by a remote attacker to perform XSS attacks.

The issue allows remote authenticated users to inject arbitrary web script or HTML via a crafted contact in the contacts application, potentially leading to cross-site scripting (XSS) attacks.

The issue allows remote attackers to inject arbitrary web script or HTML via the Host header to lib/web.php. This is a cross-site scripting (XSS) vulnerability.

The issue allows remote authenticated users to read arbitrary folders by either leveraging an active folder tab loaded before permissions were removed or via the `folder` parameter to "artefact/file/groupfiles.php".