Some vulnerabilities have been reported in Moodle, which can be exploited by malicious people to conduct HTTP header injection attacks, disclose potentially sensitive information, and bypass certain security restrictions.

1) An error related to the messaging interface using user/action_redir can lead to disclosure of the email address of a user.

2) The weakness is caused due to improper handling of HTTP request headers related to calendar/set.php and can be exploited to inject arbitrary headers.

3) The security issue is caused due to improper handling of IP address restrictions via XMLRPC and can lead to a bypass of the restrictions.

The vulnerabilities are reported in versions 1.9 through 1.9.14+.

Solution
Update to version 1.9.15 or later.

Provided and/or discovered by
The vendor credits:
1) Fernando Graells
2) David Michael Evans, German Sanchez Garces
3) Patrick McNeill

Changelog
Further details available to Secunia VIM customers

Original Advisory
Moodle (MSA-11-0047, MSA-11-0049, and MSA-11-0054):
http://moodle.org/mod/forum/discuss.php?d=191754
http://moodle.org/mod/forum/discuss.php?d=191756
http://moodle.org/mod/forum/discuss.php?d=191762

Deep Links
Links available to Secunia VIM customers