Author: Fortify Security Team

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the “next” parameter which then redirects to any domain irrespective of the Host header.

In Moodle 3.x, XSS can occur via evidence of prior learning.

In Moodle 3.x, XSS can occur via attachments to evidence of prior learning.

In Moodle 2.x and 3.x, SQL injection can occur via user preferences.

In Moodle 3.2.x, global search displays user names for unauthenticated users.