Vincent Schneider

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A flaw was found in the software, allowing unauthorized users to access and view RSS feeds due to insufficient capability checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A flaw was found in Moodle, specifically a remote code execution risk in the Moodle LMS EQUELLA repository. This repository is only available to teachers and managers by default on sites where it is enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A flaw was found in Moodle, specifically a remote code execution risk in the Moodle LMS Dropbox repository. This risk is only available to teachers and managers on sites with the Dropbox repository enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A security issue was discovered that allows anyone to duplicate existing tours without needing to log in due to a lack of protection against cross-site request forgery (CSRF) attacks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A flaw was found in the analysis request action in the Brickfield tool, which did not include the necessary token to prevent a Cross-site request forgery (CSRF) risk. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined. **Description** A stored XSS risk was identified in the drag-and-drop onto image (ddimageortext) question type, which required additional sanitizing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** fedoraproject fedora (affected versions not specified) moodle (affected versions not specified) **Description** The issue is related to incorrect CSRF token checks, which resulted in multiple CSRF risks. There is no information available about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** The issue arises in a shared hosting environment that has been misconfigured, allowing access to other users' content. A Moodle user with access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A remote code execution risk was identified in the Lesson activity of Moodle. This issue is related to incorrect code generation management. By default, the Lesson activity was only available to teachers and managers. The exploitation of this issue may allow a remote attacker to execute arbitrary code. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle (affected versions not specified) **Description** A remote code execution risk was identified in the IMSCP activity. By default, this was only available to teachers and managers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Moodle versions prior to 4.1.1 **Description** The issue is related to insufficient validation of profile field availability conditions, which results in an SQL injection risk. By default, this risk is only available to teachers and managers. **Recommendations** For versions prior to 4.1.1, update to version 4.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to profile fields for teachers and managers until a patch is available.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue is related to insufficient sanitizing in the backup process, resulting in an arbitrary file read risk. By default, the capability to access this feature is only available to teachers, managers, and admins. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.