263 matches found
CVE-2009-2009
Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 curdirpath parameter to main/document/slideshow.php and the 2 file parameter to main/exercice/testheaderpage.php...
CVE-2009-2006
Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 searchterm parameter to main/auth/courses.php; the 2 frmtitle and 3 frmcontent parameters in a new personal agenda item action; the 4...
CVE-2009-2007
Multiple directory traversal vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to 1 read portions of arbitrary files via a .. dot dot and a ..\ dot dot backslash in the lang parameter to main/exercice/hotspotlangconversion.php and 2 read arbitrary files via a .. dot do...
Sql injection
Multiple SQL injection vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 uInfo parameter to main/tracking/userLog.php and the 2 course parameter to main/mySpace/lptracking.php, a different vector than CVE-2009-2006.2...
CVE-2009-2004
Multiple SQL injection vulnerabilities in main/mySpace/myStudents.php in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 student and 2 course parameters, a different vector than CVE-2007-2902...
CVE-2009-2008
Multiple SQL injection vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to execute arbitrary SQL commands via the 1 uInfo parameter to main/tracking/userLog.php and the 2 course parameter to main/mySpace/lptracking.php, a different vector than CVE-2009-2006.2...
CVE-2009-2007
Multiple directory traversal vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to 1 read portions of arbitrary files via a .. dot dot and a ..\ dot dot backslash in the lang parameter to main/exercice/hotspotlangconversion.php and 2 read arbitrary files via a .. dot do...
CVE-2009-2008
CVE-2009-2008 concerns multiple SQL injection vulnerabilities in Dokeos 1.8.5 (and possibly earlier). The flaws allow remote attackers to execute arbitrary SQL commands through the (1) uInfo parameter to main/tracking/userLog.php and the (2) course parameter to main/mySpace/lp_tracking.php, a vec...
CVE-2009-2006
CVE-2009-2006 : Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.5 (and possibly earlier) allow remote attackers to inject arbitrary script/HTML via several parameters in main/auth/courses.php, main/mySpace/myStudents.php, and related actions. Vectors 2 and 3 may require a separa...
CVE-2009-2005
CVE-2009-2005 describes a CSRF vulnerability in Dokeos 1.8.5 (and possibly earlier) that could allow an attacker to hijack an authenticated session and add new personal agenda items via unknown vectors. The connected documents identify the affected product and the basic impact, but do not provide...
CVE-2009-2009
CVE-2009-2009 affects Dokeos 1.8.5 (and possibly earlier). The vulnerability involves multiple cross-site scripting (XSS) vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via two parameters: (1) curdirpath in main/document/slideshow.php and (2) file in main/exerc...
CVE-2009-2005
Cross-site request forgery CSRF vulnerability in Dokeos 1.8.5, and possibly earlier, allows remote attackers to hijack the authentication of unspecified victims and add new personal agenda items via unknown vectors...
CVE-2009-2009
Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 curdirpath parameter to main/document/slideshow.php and the 2 file parameter to main/exercice/testheaderpage.php...
CVE-2009-2007
CVE-2009-2007 corresponds to multiple directory traversal vulnerabilities in Dokeos 1.8.5 (and possibly earlier). The flaws allow remote attackers to read portions of arbitrary files through two parameters: lang in main/exercice/hotspot_lang_conversion.php (using .. or ..\ in the value) doc_url i...
CVE-2009-2004
CVE-2009-2004 / CVE-2007-2902 involve multiple SQL injection vulnerabilities in Dokeos. The CVE-2009-2004 entry describes SQLi in main/mySpace/myStudents.php affecting Dokeos 1.8.5 and possibly earlier, allowing remote attackers to execute arbitrary SQL commands via the (1) student and (2) course...
Dokeos Multiple Remote Input Validation Vulnerabilities
Dokeos is prone to multiple input-validation vulnerabilities, including SQL-injection, HTML-injection, cross-site scripting, and cross-site request-forgery issues. Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, obta...
Dokeos 'whoisonline.php' Remote Code Execution Vulnerability
Dokeos is prone to a remote code-execution vulnerability because the software fails to adequately sanitize user-supplied input. Exploiting this issue could allow an attacker to execute arbitrary code in the context of the vulnerable application. Dokeos prior to version 1.8.5 are vulnerable. OpenV...
Dokeos < 1.8.5 'whoisonline.php' RCE Vulnerability
Dokeos is prone to a remote code-execution RCE vulnerability because the software fails to adequately sanitize user-supplied input. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...
Dokeos Detection
This host is running Dokeos, a open source online learning suite. OpenVAS Vulnerability Test $Id: dokeosdetect.nasl 5721 2017-03-24 14:42:01Z cfi $ Dokeos Detection Authors: Michael Meyer Copyright: Copyright c 2009 Greenbone Networks GmbH This program is free software; you can redistribute it...
Dokeos LMS <= 1.8.5 (include) Remote Code Execution Exploit
No description provided by source. !/usr/bin/perl Dokeos LMS = 1.8.5 "include" Remote Code Execution Exploit Description --------------------------------------------------------------- Dokeos LMS contains one flaw that allows an attacker to include a local file with "html" extension. The issue is...