PT-2013-4510

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via crafted input...

CVE-2013-3605: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies...

CVE-2013-3601: Undefined Security Weakness

Coursemill Learning Management System LMS 6.6 does not properly restrict JSP function calls, which allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter...

PT-2013-4508

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the docID parameter in the "admindocumentworker.jsp" page. Recommendations Fo...

PT-2013-4511

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users via vectors related to cookies. Recommendations For version 6.6,...

PT-2013-5741

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.8 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via crafted input...

PT-2013-5740

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.8 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The injection can occu...

PT-2013-4509

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via vectors related to error messages. Recommendations For version 6.6,...

CVE-2013-5706: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via vectors related to error messages and 1 crafted event attributes or 2 greater than characters that are optional within a browser's...

CVE-2013-3603: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Coursemill Learning Management System LMS 6.6 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages...

CVE-2013-3602: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admindocumentworker.jsp in Coursemill Learning Management System LMS 6.6 allows remote authenticated users to execute arbitrary SQL commands via the docID parameter...

CVE-2013-3604: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.6 allow remote attackers to inject arbitrary web script or HTML via crafted input...

CVE-2013-5707: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Coursemill Learning Management System LMS 6.8 allow remote attackers to inject arbitrary web script or HTML via crafted input containing a %22 sequence, a different issue than CVE-2013-3604...

CVE-2013-3600: Improper Input Validation

Coursemill Learning Management System LMS 6.6 allows remote authenticated users to gain privileges via a modified userid value to unspecified functions...

PT-2013-4507

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue allows remote authenticated users to perform arbitrary JSP operations by leveraging the Student role and providing an op parameter. This is due to the system not...

PT-2013-5742

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.8 Description The issue allows remote attackers to conduct cross-site request forgery CSRF attacks via vectors related to cookies. This is due to the system constructing secret tokens based o...

CVE-2013-3599: Improper Input Validation

userlogin.jsp in Coursemill Learning Management System LMS 6.6 and 6.8 allows remote attackers to gain privileges via a modified user-role value to home.html...

PT-2013-4506

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS version 6.6 Description The issue allows remote authenticated users to gain privileges via a modified userid value to unspecified functions. Recommendations For version 6.6, consider restricting access...

CVE-2013-5708: Cross-Site Request Forgery (CSRF)

Coursemill Learning Management System LMS 6.8 constructs secret tokens based on time values, which makes it easier for remote attackers to conduct cross-site request forgery CSRF attacks via vectors related to cookies, a different vulnerability than CVE-2013-3605...

PT-2013-4505

Name of the Vulnerable Software and Affected Versions Coursemill Learning Management System LMS versions 6.6 through 6.8 Description The issue allows remote attackers to gain privileges. This is achieved by modifying the user-role value to access home.html through the userlogin.jsp page...