CVE-2013-5708: Cross-Site Request Forgery (CSRF)

Coursemill Learning Management System LMS 6.8 constructs secret tokens based on time values, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via vectors related to cookies, a different vulnerability than CVE-2013-3605...

CVE-2013-5706: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and 1 crafted event attributes or 2 greater than characters that are optional within a browser's...

CVE-2013-3605: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-3599: Improper Input Validation

userlogin.jsp in Coursemill Learning Management System LMS 6.6 and 6.8 allows remote attackers to gain privileges via a modified user-role value to home.html...

CVE-2013-3600: Improper Input Validation

Coursemill Learning Management System LMS 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions...

CVE-2013-3601: Undefined Security Weakness

Coursemill Learning Management System LMS 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter...

CVE-2013-3602: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System LMS 6.6 allows remote authenticated users to execute arbitrary SQL commands via the docID parameter...

CVE-2013-5707: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via crafted input containing a %22 sequence, a different issue than CVE-2013-3604...

Inquisiq R3 (LMS) - Multiple Persistent Vulnerabilities

Document Title: =============== Inquisiq R3 LMS - Multiple Persistent Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=317 Release Date: ============= 2012-01-27 Vulnerability Laboratory ID VL-ID: ==================================== 317...

PG eLms Pro vDEC_2007_01 - Multiple Blind SQL Injections

PG eLMS Pro vDEC200701 Multiple Blind SQL Injection Vulnerabilities Vendor: PilotGroup Ltd Product web page: http://www.elmspro.com Affected version: DEC200701 Summary: eLMS Pro solution is an outstanding and yet simple Learning Management system. Our product is designed for any education...

eLMS Pro SQL Injection / Cross Site Scripting

======================================= eLMS Pro SQLi and XSS Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database...

eLMS Pro SQLi and XSS Vulnerability

Exploit for php platform in category web applications =================================== eLMS Pro SQLi and XSS Vulnerability =================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1...

eLms Pro - SQL Injection Cross-Site Scripting

eLms Pro - SQL Injection Cross-Site Scripting ======================================= eLMS Pro SQLi and XSS Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 ...

eLms Pro - SQL Injection / Cross-Site Scripting

======================================= eLMS Pro SQLi and XSS Vulnerability ======================================= 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //\ \ /' \ /\ //\ Exploit database...

MULTIPLE ARBITRARY INFORMATION DISCLOSURE AND EDITION --ILIAS LMS <= 3.10.7/3.9.9-->

-------------------------------------------------------------------------------------- MULTIPLE ARBITRARY INFORMATION DISCLOSURE AND EDITION --ILIAS LMS = 3.10.7/3.9.9-- -------------------------------------------------------------------------------------- CMS INFORMATION: --WEB:...

ILIAS LMS <= 3.9.9/3.10.7 Arbitrary Edition/Info Disclosure Vulns

No description provided by source. || || || -----------------------------------------\ == -- ----------- ---------------------------- ------------------/ ME VOY A LA PLAYA!...QUE CALOoOoOoR!...Lo0oL Ä„PROUD TO BE SPANISH! ------------------------------------...

ILIAS LMS <= 3.9.9/3.10.7 Arbitrary Edition/Info Disclosure Vulns

Exploit for unknown platform in category web applications ================================================================= ILIAS LMS WEB: http://www.ilias.de/ | |--DOWNLOAD: http://www.ilias.de/docu/goto.php?target=st22935&clientid=docu | |--DEMO: http://www.demo.ilias-support.com/ | |--CATEGORY...

atutor155-xss.txt

====================================================================== ATutor Impact: Cross Site Scripting Status: patch available ------------------------------ Affected software description: ------------------------------ Application: ATutor Version: = 1.5.5 Vendor: http://www.atutor.ca...

dokeos-xss.txt

HSC Dokeos Multiple Cross-Site Scripting Vulnerabilities Dokeos is a learning management systemused to manage e-learning. It's prone to cross-site scripting vulnerability. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the conte...

CVE-2007-6338

SQL injection vulnerability in userlogin.jsp in Trivantis CourseMill Enterprise Learning Management System 4.1 SP4 allows remote attackers to execute arbitrary SQL commands via the user parameter username field. NOTE: some of these details are obtained from third party information...