Merge pull request #1103 from mickhawkins/main

[docs] Add security announcements to 4.4.2 and friends

Author: andrewnicols

general/releases/4.1/4.1.12.md

@@ -32,5 +32,19 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
+- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
+- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
+- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
+- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
+- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
+- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
+- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
+- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
+- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
+- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
+- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
+- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
+- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
+<!-- cspell:enable -->

general/releases/4.2/4.2.9.md

@@ -30,5 +30,19 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
+- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
+- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
+- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
+- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
+- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
+- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
+- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
+- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
+- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
+- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
+- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
+- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
+- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
+<!-- cspell:enable -->

general/releases/4.3/4.3.6.md

@@ -95,5 +95,20 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
+- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
+- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
+- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
+- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
+- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
+- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
+- [MSA-24-0034](https://moodle.org/mod/forum/discuss.php?d=461202) - Matrix user/power level management not always working as expected with suspended users
+- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
+- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
+- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
+- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
+- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
+- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
+- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
+<!-- cspell:enable -->

general/releases/4.4/4.4.2.md

@@ -104,5 +104,21 @@ import { ReleaseNoteIntro } from '@site/src/components/ReleaseInformation';
 <!-- cspell:enable -->
 
 ## Security fixes
-
-A number of security related issues were resolved. Details of these issues will be released after a period of approximately one week to allow system administrators to safely update to the latest version.
+<!-- cspell:disable -->
+- [MSA-24-0026](https://moodle.org/mod/forum/discuss.php?d=461193) - Remote code execution via calculated question types
+- [MSA-24-0027](https://moodle.org/mod/forum/discuss.php?d=461194) - Arbitrary file read risk through pdfTeX
+- [MSA-24-0028](https://moodle.org/mod/forum/discuss.php?d=461195) - Admin presets export tool includes some secrets that should not be exported
+- [MSA-24-0029](https://moodle.org/mod/forum/discuss.php?d=461196) - Cache poisoning via injection into storage
+- [MSA-24-0030](https://moodle.org/mod/forum/discuss.php?d=461197) - User information visibility control issues in gradebook reports
+- [MSA-24-0031](https://moodle.org/mod/forum/discuss.php?d=461198) - Lack of access control when using external methods for Quiz overrides
+- [MSA-24-0032](https://moodle.org/mod/forum/discuss.php?d=461199) - IDOR in badges allows deletion of arbitrary badges
+- [MSA-24-0033](https://moodle.org/mod/forum/discuss.php?d=461200) - Authorization headers preserved between "emulated redirects"
+- [MSA-24-0034](https://moodle.org/mod/forum/discuss.php?d=461202) - Matrix user/power level management not always working as expected with suspended users
+- [MSA-24-0035](https://moodle.org/mod/forum/discuss.php?d=461203) - CSRF risk in Feedback non-respondents report
+- [MSA-24-0036](https://moodle.org/mod/forum/discuss.php?d=461205) - Can create global glossary without being admin
+- [MSA-24-0037](https://moodle.org/mod/forum/discuss.php?d=461206) - Site administration SQL injection via XMLDB editor
+- [MSA-24-0038](https://moodle.org/mod/forum/discuss.php?d=461207) - XSS risk when restoring malicious course backup file
+- [MSA-24-0039](https://moodle.org/mod/forum/discuss.php?d=461208) - IDOR in Feedback non-respondents report allows messaging arbitrary site users
+- [MSA-24-0040](https://moodle.org/mod/forum/discuss.php?d=461209) - Reflected XSS via H5P error message
+- [MSA-24-0041](https://moodle.org/mod/forum/discuss.php?d=461210) - LFI vulnerability when restoring malformed block backups
+<!-- cspell:enable -->