Andrew Nicols

A vulnerability was found where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. This occurred because Mustache helper tags included in template contexts were not being escaped before the context was injected into another Mustache helper, which could result in script injection in some templates.

A vulnerability was found in Moodle where activity creation capabilities were not correctly respected when selecting the activity to use for a course in single activity mode.

A vulnerability was found in Moodle where users with the capability to create courses were assigned as a teacher in those courses, regardless of whether they had the capability to be automatically assigned that role.

A vulnerability was found where the `get with capability join` and `get users by capability` functions did not account for context freezing when checking user capabilities.

A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack user authentication for requests that mark forum posts as read.

The issue is related to insufficient access control in the course notes viewing capability, which is checked in the wrong context. This can potentially allow a remote attacker to elevate their privileges.

The issue is related to insufficient restriction of the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file. This can be exploited by a remote attacker to perform XSS attacks.

The issue allows remote attackers to inject arbitrary web script or HTML by providing a crafted `playerId` or referencing an external domain. This can lead to cross-site scripting (XSS) attacks.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. This is due to a vulnerability in the flashuploader.swf file within the Uploader component.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. This is due to a vulnerability in the uploader.swf component of Yahoo! YUI.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. This occurs due to a regression.

A cross-site scripting (XSS) issue exists in the IO Utility component, specifically in io.swf, allowing remote attackers to inject arbitrary web script or HTML via a crafted string in a URL. This affects various products, including Moodle, that utilize YUI. The `uploader.swf` and `io.swf` utilities are vulnerable to script injection in the URL.

The issue allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the `login as` feature.

The issue affects the messaging system in Moodle, specifically in the user/messageselect.php file. It allows remote attackers to hijack the authentication of arbitrary users for requests that send course messages due to multiple cross-site request forgery (CSRF) vulnerabilities.

The issue concerns the improper implementation of access restrictions in a Q&A forum, allowing remote authenticated users with the student role to bypass intended restrictions by reading the RSS feed for a forum.

The issue is related to the `is enrolled` function in `lib/accesslib.php`, which does not properly interact with the caching feature. This might allow remote authenticated users to bypass an intended capability check via unspecified vectors that trigger caching of a user record.