PT-2008-4824 · Blackboard · Blackboard Academic Suite

Name of the Vulnerable Software and Affected Versions: Blackboard Academic Suite version 8.0.260.7 Description: The issue affects the authentication of student users, allowing remote attackers to hijack it for requests that change configuration and enrollments. This is achieved through unspecifie...

Directory traversal

Directory traversal vulnerability in download.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to read arbitrary files via a .. dot dot in the dfile parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 query string to login.php and the 2 glbsid parameter to hta/htmlarea.js.php, and allow remote authenticated...

CVE-2008-2968

SQL injection vulnerability in rating.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the bookid parameter...

Session fixation

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

CVE-2008-2969

Directory traversal vulnerability in download.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to read arbitrary files via a .. dot dot in the dfile parameter...

CVE-2008-2967

Multiple cross-site scripting XSS vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 query string to login.php and the 2 glbsid parameter to hta/htmlarea.js.php, and allow remote authenticated...

Sql injection

SQL injection vulnerability in rating.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the bookid parameter...

CVE-2008-2970

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

CVE-2008-2968

CVE-2008-2968 is a SQL injection vulnerability in rating.php of Academic Web Tools (AWT YEKTA) prior to or including version 1.4.3.1 and 1.4.2.8, exploitable via the book_id parameter to allow remote execution of arbitrary SQL commands. The vulnerability is documented with a CVSS v2 base score of...

CVE-2008-2969

The CVE-2008-2969 entry concerns a directory traversal vulnerability in Academic Web Tools (AWT YEKTA) versions 1.4.3.1 and 1.4.2.8 (and earlier). The underlying issue is that the dfile parameter can be manipulated with a .. (dot dot) path segment in download.php, allowing remote attackers to rea...

CVE-2008-2969

Directory traversal vulnerability in download.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to read arbitrary files via a .. dot dot in the dfile parameter...

CVE-2008-2968

SQL injection vulnerability in rating.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to execute arbitrary SQL commands via the bookid parameter...

CVE-2008-2970

Multiple session fixation vulnerabilities in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allow remote attackers to hijack web sessions by setting the PHPSESSID parameter to 1 index.php and 2 login.php in homepg/...

Open redirect

Open redirect vulnerability in rssgetfile.php in Academic Web Tools AWT YEKTA 1.4.3.1, and 1.4.2.8 and earlier, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the file parameter...

CVE-2008-2878

CVE-2008-2878 is an open redirect vulnerability in rss_getfile.php of Academic Web Tools (AWT YEKTA), affecting versions 1.4.3.1 and 1.4.2.8 and earlier. The flaw allows remote attackers to redirect users to arbitrary websites and facilitate phishing via a URL supplied in the file parameter. The ...

Academic Web Tools CMS <= 1.4.2.8 Multiple Vulnerabilities

No description provided by source. www.BugReport.ir AmnPardaz Security Research Team Title: Academic Web Tools CMS Multiple Vulnerabilities Vendor: www.yektaweb.com Vulnerable Version: 1.4.2.8 and prior versions Exploit: Available Impact: Medium Fix: N/A Original Advisory: www.bugreport.ir/?/44 1...

Academic Web Tools CMS <= 1.4.2.8 Multiple Vulnerabilities

Exploit for unknown platform in category web applications ========================================================== Academic Web Tools CMS = 1.4.2.8 Multiple Vulnerabilities ========================================================== AmnPardaz Security Research Team Title: Academic Web Tools CMS...

Yektaweb Academic Web Tools CMS 1.4.2.8 - Multiple Vulnerabilities

Yektaweb Academic Web Tools CMS 1.4.2.8 - Multiple Vulnerabilities www.BugReport.ir AmnPardaz Security Research Team Title: Academic Web Tools CMS Multiple Vulnerabilities Vendor: www.yektaweb.com Vulnerable Version: 1.4.2.8 and prior versions Exploit: Available Impact: Medium Fix: N/A Original...

academic-sqlxss.txt

www.BugReport.ir AmnPardaz Security Research Team Title: Academic Web Tools CMS Multiple Vulnerabilities Vendor: www.yektaweb.com Vulnerable Version: 1.4.2.8 and prior versions Exploit: Available Impact: Medium Fix: N/A Original Advisory: www.bugreport.ir/?/44 1. Description: ACADEMIC WEB TOOLS A...