474 matches found
Directory traversal
The Learning Module in ILIAS 7.25 2023-09-12 release allows an attacker with basic user privileges to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can move specified directories, normally outside...
Directory traversal
ILIAS 2013-09-12 release contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential fil...
CVE-2023-45868
The Learning Module in ILIAS 7.25 2023-09-12 release allows an attacker with basic user privileges to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can move specified directories, normally outside...
ILIAS Security Vulnerabilities
ILIAS is an open source learning management system. A security vulnerability exists in ILIAS version 7.25 that originates from allowing any authenticated user to remotely execute arbitrary operating system commands...
CVE-2023-45867
ILIAS (2013-09-12 release) contains a Directory Traversal local file inclusion vulnerability in the ScormAicc module (CVE-2023-45867). An attacker with a privileged account (typically tutor) can manipulate a URL file parameter to traverse directories and read files readable by the web server user...
CVE-2023-45867
ILIAS 2013-09-12 release contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential fil...
CVE-2023-45869
ILIAS 7.25 2023-09-12 allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec function in the execQuoted method of the ilUtil class...
CVE-2023-45868
The Learning Module in ILIAS 7.25 2023-09-12 release allows an attacker with basic user privileges to achieve a high-impact Directory Traversal attack on confidentiality and availability. By exploiting this network-based vulnerability, the attacker can move specified directories, normally outside...
ILIAS Security Vulnerabilities
ILIAS is an open source learning management system. A security vulnerability exists in ILIAS version 7.25 that stems from allowing an attacker to conduct a high-impact directory traversal attack, which could result in a complete loss of confidentiality, exposure of sensitive resources, and denial...
CVE-2023-45867
ILIAS 2013-09-12 release contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential fil...
CVE-2023-45869
ILIAS 7.25 2023-09-12 allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec function in the execQuoted method of the ilUtil class...
ILIAS Security Vulnerabilities
ILIAS is an open source learning management system. A security vulnerability exists in ILIAS that stems from the presence of a directory traversal and local file inclusion vulnerability, which allows an attacker to gain unauthorized access to and retrieve confidential files stored on a web server...
CVE-2023-45868
CVE-2023-45868 concerns the Learning Module in ILIAS 7.25 (2023-09-12 release). The vulnerability allows a high-impact Directory Traversal leading to confidentiality and availability loss. An attacker with basic user privileges can exploit the issue by manipulating a POST request during exercise ...
CVE-2023-45869
CVE-2023-45869 affects ILIAS 7.25 (2023-09-12). The issue resides in the ilUtil::execQuoted() function (via the exec() call) which lacks input sanitization, allowing any authenticated user to remotely execute arbitrary operating system commands when a highly privileged account loads an XSS payloa...
CVE-2023-45867
ILIAS 2013-09-12 release contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential fil...
CVE-2023-45869
ILIAS 7.25 2023-09-12 allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec function in the execQuoted method of the ilUtil class...
PT-2023-6722 · Ilias · Ilias
Name of the Vulnerable Software and Affected Versions: ILIAS version 7.25 Description: The issue exists due to incorrect restriction of the path name to a directory with limited access in the Learning Module component of the ILIAS learning management system. Exploitation of this issue may allow a...
PT-2023-6719 · Ilias · Ilias
Name of the Vulnerable Software and Affected Versions: ILIAS version 7.25 Description: The issue is related to the exec function in the execQuoted method of the ilUtil class, which lacks input sanitization. This allows attackers to inject malicious commands into the system, potentially compromisi...
ILIAS eLearning Platform XSS / Remote Code Execution
SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple high risk vulnerabilities product: ILIAS eLearning platform vulnerable version: see section "Vulnerable version" below fixed version: see section "Solution" belo...
