CVE-2015-2273

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...

Design/Logic Flaw

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

CVE-2015-2273

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...

CVE-2015-2273: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...

CVE-2015-3180: Exposure of Sensitive Information to an Unauthorized Actor

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

某通用型大学生管理系统SQL注入

简要描述： RT 详细说明： 注入链接： /zhanshikebiao.aspx?centid= 案例： http://syjx.njxzc.edu.cn/zhanshikebiao.aspx?centid=799&date=2013-12-20&xyid= http://lab.njnu.edu.cn/dkysy/zhanshikebiao.aspx?centid=23&date=2013-12-13&xyid= http://coalab.njupt.edu.cn/nykzsy/zhanshikebiao.aspx?centid=702&date=2015-3-21&xyid=...

WS-2015-0073

In TEAMMATES/teammates, versions V4.98 to V5.41 the student feedback submission was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript...

某用户量较大的综合管理系统mssql注射漏洞

简要描述： 大量学生综合系统使用安脉的。 详细说明： 厂商： 上海安脉计算机科技有限公司 http://www.anmai.net/ SQL注射点： /oa/news/updateAffiche.aspx?id=1 其中id参数存在sql注射 互联网自动采集案例5枚： http://zhgl.w25z.cn/ANMAI/oa/news/updateAffiche.aspx?id=1 http://www.jukui.com/ANMAI/oa/news/updateAffiche.aspx?id=1...

某通用型校园系统多处系统越权

简要描述： 见详情 详细说明： 漏洞证明： 看乌云别人提交，看了下： 关键字：SM2005/ 多处越权： 第一处：无需登陆可查看任意教师，任意学期的班级课表 漏洞位置：SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingweb 案例如下： http://www.sdwhys.com/SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingweb http://www.zjnksyzx.com:8801/SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingw...

某校园系统一处遗漏通用SQL注入漏洞

简要描述： 校园系统通用SQL注入 详细说明： 漏洞细节： 见乌云，URL： WooYun: 某通用型校园校务系统SQL注入 属于遗漏一处： 漏洞位置在学生成绩查询处的输入处 位置：SM2005/student/StuCJ/StuScoreQuery.asp?sYanzheng=suyaxingweb 注入参数：StartKSID 借用前人案例：...

White House Creates Cyber Governance Unit Within OMB

With the framework explained for a number of government cybersecurity-related initiatives, now it’s time to talk money. The White House anted up strong in 2015 with proposals for a new data breach notification standard, as well as plans to facilitate information-sharing between the public and...

CVE-2014-7831

lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...

PT-2014-8298

Name of the Vulnerable Software and Affected Versions Moodle versions 2.7.x through 2.7.2 Description The issue allows remote authenticated users to obtain sensitive information by accessing the get grades web service, leveraging the student role. This occurs because the lib/classes/grades...

CVE-2014-7831: Exposure of Sensitive Information to an Unauthorized Actor

lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...

Mozilla.org Cross Site Scripting

Domains: http://lxr.mozilla.org/ http://mxr.mozilla.org/ The two domains above are almost the same Websites information: lxr.mozilla.org, mxr.mozilla.org are cross references designed to display the Mozilla source code. The sources displayed are those that are currently checked in to the mainline...

CVE-2014-7068

The Neumann Student Activities aka com.appmakr.app153856 application 216607 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Information disclosure

The Neumann Student Activities aka com.appmakr.app153856 application 216607 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-7068

The vulnerability CVE-2014-7068 affects the Android app named Neumann Student Activities (package com.appmakr.app153856, version 216607). The root cause is that the application does not verify X.509 certificates from SSL servers, enabling man-in-the-middle attackers to spoof servers and access se...

CVE-2014-7068

The Neumann Student Activities aka com.appmakr.app153856 application 216607 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

PT-2014-7992

Name of the Vulnerable Software and Affected Versions The Student ID application version 1.2 Description The issue concerns a lack of verification of X.509 certificates from SSL servers, allowing man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...