PT-2024-16300 · WordPress · Wplms Learning Management System

Name of the Vulnerable Software and Affected Versions: WPLMS Learning Management System for WordPress versions prior to 4.963 Description: The WPLMS Learning Management System for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation and permissions...

Moodle 2.3.9, 2.4.6 - Multiple Vulnerabilities

Moodle versions 2.3.9 and below and 2.4.6 suffer from a javascript insertion vulnerability that allows for the addition of an RSS blog. Ciaran McNally Application: Moodle http://download.moodle.org/ Versions: parameter in an rss feed is vulnerable to javascript injection. This blog post is viewab...

Moodle 2.3.82.4.5 - Multiple Vulnerabilities

Moodle 2.3.82.4.5 - Multiple Vulnerabilities Ciaran McNally Application: Moodle http://download.moodle.org/ Versions: parameter in an rss feed is vulnerable to javascript injection. This blog post is viewable by everyone on moodle and you can link to it directly. Upon clicking the "Link to origin...

CVE-2013-3605

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-5708

CVE-2013-5708 affects Coursemill Learning Management System (LMS) 6.8. The vulnerability arises because it constructs secret tokens based on time values, which enables remote attackers to perform cross-site request forgery (CSRF) via cookie-related vectors. This is described as a different vulner...

CVE-2013-3605

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-3601

Affected software: Coursemill Learning Management System (LMS) 6.6. Vulnerability: inadequate restriction of JSP function calls allows remote authenticated users (via Student role) to perform arbitrary JSP operations by supplying an op parameter. Impact: privilege escalation to execute restricted...

PT-2013-4510

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via crafted input...

PT-2013-4508

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the docID parameter in the "admindocumentworker.jsp" page. Recommendations Fo...

PT-2013-5740

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.8 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occu...

PT-2013-4506

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue allows remote authenticated users to gain privileges via a modified userid value to unspecified functions. Recommendations For version 6.6, consider restricting access...

PT-2013-4505

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS versions 6.6 through 6.8 Description The issue allows remote attackers to gain privileges. This is achieved by modifying the user-role value to access home.html through the userlogin.jsp page...

CVE-2013-5707: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via crafted input containing a %22 sequence, a different issue than CVE-2013-3604...

CVE-2013-3602: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System LMS 6.6 allows remote authenticated users to execute arbitrary SQL commands via the docID parameter...

CVE-2013-3605: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-3601: Undefined Security Weakness

Coursemill Learning Management System LMS 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter...

CVE-2013-3599: Improper Input Validation

userlogin.jsp in Coursemill Learning Management System LMS 6.6 and 6.8 allows remote attackers to gain privileges via a modified user-role value to home.html...

CVE-2013-3600: Improper Input Validation

Coursemill Learning Management System LMS 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions...

CVE-2013-5706: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and 1 crafted event attributes or 2 greater than characters that are optional within a browser's...

CVE-2013-5708: Cross-Site Request Forgery (CSRF)

Coursemill Learning Management System LMS 6.8 constructs secret tokens based on time values, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via vectors related to cookies, a different vulnerability than CVE-2013-3605...