Dokeos cross-site scripting vulnerability

Overview Dokeos, an open source e-learning content management system, contains a cross-site scripting vulnerability. Impact An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, an attacker could possibly conduct session...

Cross site scripting

Cross-site scripting XSS vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors...

CVE-2008-1223

Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors...

CVE-2008-1223

Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors...

CVE-2008-1223

CVE-2008-1223 affects Dokeos 1.8.4 before SP3. The vulnerability is described as an unspecified vulnerability allowing arbitrary code execution via unspecified vectors. Connected sources do not provide concrete technical details (no exposed root cause, affected component, or patch/version fixes b...

CVE-2008-1222

CVE-2008-1222 is an XSS in Dokeos 1.8.4 before SP3. Remote attackers can inject arbitrary script/HTML via unspecified vectors. The connected sources confirm the affected product and vulnerability type; no detailed root cause, exact vectors, or patch specifics are provided in the documents. No exp...

CVE-2008-1222

Cross-site scripting XSS vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Dokeos远程命令执行漏洞

Dokeos是一款开源在线教育解决方案。 Dokeos不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB权限执行任意命令。 目前没有详细漏洞细节提供。 Dokeos Open Source Learning & Knowledge Management Tool 1.8.4 SP2 Dokeos Open Source Learning & Knowledge Management Tool 1.8.4 Dokeos Open Source Learning & Knowledge Management Tool 1.8.4 SP1 升级程序： Dokeos Open...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to inscription.php, 2 courseCode parameter to main/calendar/myagenda.php, 3 category parameter to main/admin/coursecategory.php, 4 message...

Sql injection

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to whoisonline.php, 2 trackinglistcoachescolumn parameter to main/mySpace/index.php, 3 tutorname parameter to main/createcourse/addcourse.php, the 4 Referer HTTP...

CVE-2008-0851

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to inscription.php, 2 courseCode parameter to main/calendar/myagenda.php, 3 category parameter to main/admin/coursecategory.php, 4 message...

CVE-2008-0850

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to whoisonline.php, 2 trackinglistcoachescolumn parameter to main/mySpace/index.php, 3 tutorname parameter to main/createcourse/addcourse.php, the 4 Referer HTTP...

CVE-2008-0851

CVE-2008-0851 affects Dokeos 1.8.4 with multiple cross-site scripting (XSS) vulnerabilities. Remote attackers can inject arbitrary web script/HTML via (1) username in inscription.php, (2) courseCode in main/calendar/myagenda.php, (3) category in main/admin/course_category.php, (4) message in main...

CVE-2008-0850

Multiple SQL injection vulnerabilities in Dokeos 1.8.4 allow remote attackers to execute arbitrary SQL commands via the 1 id parameter to whoisonline.php, 2 trackinglistcoachescolumn parameter to main/mySpace/index.php, 3 tutorname parameter to main/createcourse/addcourse.php, the 4 Referer HTTP...

CVE-2008-0851

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.4 allow remote attackers to inject arbitrary web script or HTML via the 1 username parameter to inscription.php, 2 courseCode parameter to main/calendar/myagenda.php, 3 category parameter to main/admin/coursecategory.php, 4 message...

CVE-2008-0850

CVE-2008-0850 concerns Dokeos 1.8.4 with multiple SQL injection vulnerabilities. The affected components include: (1) id parameter in whoisonline.php, (2) tracking_list_coaches_column parameter in main/mySpace/index.php, (3) tutor_name parameter in main/create_course/add_course.php, (4) Referer H...

[DSECRG-08-015] Multiple Security Vulnerabilities in Dokeos 1.8.4

Digital Security Research Group DSecRG Advisory DSECRG-08-015 Application: Dokeos E-Learning System Versions Affected: 1.8.4 Vendor URL: http://dokeos.com Bugs: Multiple SQL Injections,Multiple Blind SQL Injections,Multiple XSS, etc. Exploits: YES Reported: 25.01.2008 Vendor response: 28.01.2008...

DSECRG-08-015.txt

Digital Security Research Group DSecRG Advisory DSECRG-08-015 Application: Dokeos E-Learning System Versions Affected: 1.8.4 Vendor URL: http://dokeos.com Bugs: Multiple SQL Injections,Multiple Blind SQL Injections,Multiple XSS, etc. Exploits: YES Reported: 25.01.2008 Vendor response: 28.01.2008...

Dokeos main/inc/lib/events.lib.inc.php Referer HTTP Header SQL Injection

The remote host is running Dokeos, an open source, e-learning and course management web application written in PHP. The version of Dokeos installed on the remote host fails to sanitize user input to the 'Referer' request header before using it in the 'main/inc/lib/events.lib.inc.php' script to...