CVE-2013-5708

CVE-2013-5708 affects Coursemill Learning Management System (LMS) 6.8. The vulnerability arises because it constructs secret tokens based on time values, which enables remote attackers to perform cross-site request forgery (CSRF) via cookie-related vectors. This is described as a different vulner...

CVE-2013-3601

Affected software: Coursemill Learning Management System (LMS) 6.6. Vulnerability: inadequate restriction of JSP function calls allows remote authenticated users (via Student role) to perform arbitrary JSP operations by supplying an op parameter. Impact: privilege escalation to execute restricted...

CVE-2013-3605

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-3599: Improper Input Validation

userlogin.jsp in Coursemill Learning Management System LMS 6.6 and 6.8 allows remote attackers to gain privileges via a modified user-role value to home.html...

CVE-2013-3605: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-3600: Improper Input Validation

Coursemill Learning Management System LMS 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions...

CVE-2013-5708: Cross-Site Request Forgery (CSRF)

Coursemill Learning Management System LMS 6.8 constructs secret tokens based on time values, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via vectors related to cookies, a different vulnerability than CVE-2013-3605...

CVE-2013-5706: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and 1 crafted event attributes or 2 greater than characters that are optional within a browser's...

CVE-2013-3603: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

CVE-2013-3604: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.6 allow remote attackers to inject arbitrary web script or HTML via crafted input...

CVE-2013-3601: Undefined Security Weakness

Coursemill Learning Management System LMS 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter...

CVE-2013-3602: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System LMS 6.6 allows remote authenticated users to execute arbitrary SQL commands via the docID parameter...

CVE-2013-5707: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via crafted input containing a %22 sequence, a different issue than CVE-2013-3604...

Inquisiq R3 (LMS) - Multiple Persistent Vulnerabilities

Document Title: =============== Inquisiq R3 LMS - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=317 Release Date: ============= 2012-01-27 Vulnerability Laboratory ID VL-ID: ==================================== 317...

PG eLms Pro vDEC_2007_01 - Multiple Blind SQL Injections

PG eLMS Pro vDEC200701 Multiple Blind SQL Injection Vulnerabilities Vendor: PilotGroup Ltd Product web page: http://www.elmspro.com Affected version: DEC200701 Summary: eLMS Pro solution is an outstanding and yet simple Learning Management system. Our product is designed for any education...

eLMS Pro SQL Injection / Cross Site Scripting

======================================= eLMS Pro SQLi and XSS Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database...

eLms Pro - SQL Injection / Cross-Site Scripting

======================================= eLMS Pro SQLi and XSS Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database...

eLMS Pro SQLi and XSS Vulnerability

Exploit for php platform in category web applications =================================== eLMS Pro SQLi and XSS Vulnerability =================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1...

eLms Pro - SQL Injection Cross-Site Scripting

eLms Pro - SQL Injection Cross-Site Scripting ======================================= eLMS Pro SQLi and XSS Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 ...

MULTIPLE ARBITRARY INFORMATION DISCLOSURE AND EDITION --ILIAS LMS <= 3.10.7/3.9.9-->

-------------------------------------------------------------------------------------- MULTIPLE ARBITRARY INFORMATION DISCLOSURE AND EDITION --ILIAS LMS = 3.10.7/3.9.9-- -------------------------------------------------------------------------------------- CMS INFORMATION: --WEB:...