272 matches found
CVE-2020-24381
GUnet Open eClass Platform aka openeclass before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default...
CVE-2020-24381
GUnet Open eClass Platform aka openeclass before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default...
Design/Logic Flaw
GUnet Open eClass Platform aka openeclass before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default...
CVE-2020-24381
GUnet Open eClass Platform (openeclass) prior to 3.11 is vulnerable to reading submitted assessments due to directory listing not being blocked and the data directory being inside the web root. This could allow remote attackers to access student submissions. The affected product/version is public...
CVE-2020-24381
GUnet Open eClass Platform aka openeclass before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default...
PT-2020-15720
Name of the Vulnerable Software and Affected Versions GUnet Open eClass Platform versions prior to 3.11 Description The issue allows remote attackers to read students' submitted assessments due to the web server not blocking directory listings and the data directory being inside the web root by...
CVE-2020-24381: Exposure of Sensitive Information to an Unauthorized Actor
GUnet Open eClass Platform aka openeclass before 3.11 might allow remote attackers to read students' submitted assessments because it does not ensure that the web server blocks directory listings, and the data directory is inside the web root by default...
eClass platform SQL Injection Vulnerability
eClass platform is an open source course management system organized by GUnet Greece. A SQL injection vulnerability exists in versions of eClass platform prior to ip.2.5.10.2.1. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. ...
CVE-2019-9884
eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...
CVE-2019-9884
eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...
CVE-2019-9885
eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...
CVE-2019-9885
eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...
Sql injection
eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...
Design/Logic Flaw
eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...
CVE-2019-9885 eClass platform contains a SQL injection vulnerability
eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...
CVE-2019-9884
CVE-2019-9884 affects the eClass platform (version
CVE-2019-9885
CVE-2019-9885 affects eClass platform prior to ip.2.5.10.2.1. The vulnerability is a SQL injection in the /admin/academic/studenview_left.php?StudentID parameter, caused by insufficient input validation in the web application. Exploitation would allow an attacker to execute arbitrary SQL commands...
CVE-2019-9884 eClass platform contains a Broken Access Control vulnerability
eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...
PT-2019-19918
Name of the Vulnerable Software and Affected Versions eClass platform version ip.2.5.10.2.1 Description The issue allows an attacker to execute SQL commands via the "/admin/academic/studenview left.php" API endpoint, specifically by manipulating the StudentID parameter. Recommendations For eClass...
CVE-2019-9884: Improper Access Control
eClass platform ip.2.5.10.2.1 allows an attacker to use GETS method to request /admin page to bypass the password validation and access management page...