Dan Poltawski

The issue allows remote attackers to cause a denial of service by triggering the calculation of an estimated latitude and longitude for an IP address, resulting in resource consumption.

The issue arises from the improper handling of a certain array-element syntax by the MoodleQuickForm class in lib/formslib.php. This allows remote attackers to bypass intended form-data filtering via a crafted request.

The issue allows remote attackers to obtain sensitive information via a crafted request, due to the lack of capability requirements enforcement for reading blog comments.

The issue is related to the moodle1 backup converter in Moodle, which does not properly validate pathnames. This allows remote authenticated users to read arbitrary files by leveraging the backup-restoration feature.

The issue allows remote attackers to read or modify the submission comments of arbitrary users via a crafted URI. This is due to a problem in the lib.php file within the Submission comments plugin in the Assignment module.

The issue allows remote attackers to bypass authentication by leveraging an unattended workstation, due to improper handling of the autocomplete attribute of a password input element.

The issue allows remote attackers to inject arbitrary web script or HTML via the `lti typename` or `lti toolurl` parameters in the mod/lti/typessettings.php file.

The issue is related to the mod/data/preset.php file in Moodle, which does not properly iterate through an array. This allows remote authenticated users to overwrite arbitrary database activity presets via unspecified vectors.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the `idnumber` field to "cohort/edit.php".

A cross-site scripting (XSS) issue exists, allowing remote authenticated users to inject arbitrary web script or HTML via the `name` field to "admin/webservice/service.php".

A cross-site request forgery (CSRF) issue exists in the forum code, allowing remote attackers to delete unauthorized forum posts via a link or IMG tag to "post.php".