CVE-2018-16970: Insertion of Sensitive Information into Externally-Accessible File or Directory

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to download non-purchased course files via a modified id parameter...

CVE-2018-16971: Authorization Bypass Through User-Controlled Key

Wisetail Learning Ecosystem LE through v4.11.6 allows insecure direct object reference IDOR attacks to access non-purchased course contents quiz / test via a modified id parameter...