CVE-2013-3604

CVE-2013-3604 concerns multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.6. The public descriptions in the provided documents state that remote attackers could inject arbitrary web script or HTML via crafted input. Connected records also referenc...

CVE-2013-3605

CVE-2013-3605 concerns Cross-site request forgery (CSRF) in Coursemill Learning Management System (LMS) 6.6, enabling remote attackers to hijack the authentication of arbitrary users via cookies. The connected documents corroborate that the vulnerability involves cookie-related CSRF in the Course...

CVE-2013-5706

CVE-2013-5706 corresponds to multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8. The issues allow remote attackers to inject arbitrary web script or HTML via error-message related vectors and two specific payload types: (1) crafted event attribu...

CVE-2013-5707

CVE-2013-5707 describes multiple XSS vulnerabilities in Coursemill Learning Management System (LMS) 6.8, enabling remote attackers to inject arbitrary web script or HTML via crafted input containing a %22 sequence. This is a separate issue from CVE-2013-3604. The NVD entry lists a MEDIUM severity...

CVE-2013-5708

CVE-2013-5708 affects Coursemill Learning Management System (LMS) 6.8. The vulnerability arises because it constructs secret tokens based on time values, which enables remote attackers to perform cross-site request forgery (CSRF) via cookie-related vectors. This is described as a different vulner...

CVE-2013-3601

Affected software: Coursemill Learning Management System (LMS) 6.6. Vulnerability: inadequate restriction of JSP function calls allows remote authenticated users (via Student role) to perform arbitrary JSP operations by supplying an op parameter. Impact: privilege escalation to execute restricted...

PT-2013-4510

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via crafted input...

PT-2013-5741

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.8 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via crafted input...

PT-2013-5742

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.8 Description The issue allows remote attackers to conduct cross-site request forgery CSRF attacks via vectors related to cookies. This is due to the system constructing secret tokens based o...

PT-2013-4507

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter. This is due to the system not...

PT-2013-5740

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.8 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occu...

PT-2013-4505

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS versions 6.6 through 6.8 Description The issue allows remote attackers to gain privileges. This is achieved by modifying the user-role value to access home.html through the userlogin.jsp page...

PT-2013-4509

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via vectors related to error messages. Recommendations For version 6.6,...

CVE-2013-3603: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

CVE-2013-5706: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and 1 crafted event attributes or 2 greater than characters that are optional within a browser's...

CVE-2013-3605: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-3599: Improper Input Validation

userlogin.jsp in Coursemill Learning Management System LMS 6.6 and 6.8 allows remote attackers to gain privileges via a modified user-role value to home.html...

CVE-2013-3600: Improper Input Validation

Coursemill Learning Management System LMS 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions...

CVE-2013-3601: Undefined Security Weakness

Coursemill Learning Management System LMS 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter...

CVE-2013-3602: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System LMS 6.6 allows remote authenticated users to execute arbitrary SQL commands via the docID parameter...