Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results

Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php

Moodle before 2.2.2: Overview report allows users to see hidden courses

Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export

Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default

Moodle before 2.2.2 has users' private files included in course backups

Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to

Moodle: idor in edit/delete rss feed

A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permission to modify.

Moodle: users' names returned in messaging error message

A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may not otherwise have access to via an error message in Messaging. Note: The name returned follows the full name format configured on the site.

Moodle: some users can delete audiences of other reports

A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they do not have permission to delete from.

Moodle: idor when fetching report schedules

A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have permission to edit that report.