From the Debian advisory:
CVE-2009-4297:
Multiple cross-site request forgery (CSRF) vulnerabilities have been
discovered.
CVE-2009-4298:
It has been discovered that the LAMS module is prone to the disclosure
of user account information.
CVE-2009-4299:
The Glossary module has an insufficient access control mechanism.
CVE-2009-4301:
Moodle does not properly check permissions when the MNET service is
enabled, which allows remote authenticated servers to execute arbitrary
MNET functions.
CVE-2009-4302:
The login/index_form.html page links to an HTTP page instead of using an
SSL secured connection.
CVE-2009-4303:
Moodle stores sensitive data in backup files, which might make it
possible for attackers to obtain them.
CVE-2009-4305:
It has been discovered that the SCORM module is prone to an SQL
injection.
Additionally, an SQL injection in the update_record function, a problem
with symbolic links and a verification problem with Glossary, database
and forum ratings have been fixed.
| 