CVE-2019-9885: Improper Neutralization of Special Elements used in an SQL Command

eClass platform ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenviewleft.php StudentID parameter...

PT-2019-19917

Name of the Vulnerable Software and Affected Versions eClass platform version ip.2.5.10.2.1 Description The issue allows an attacker to bypass password validation and access the management page by using the GET method to request the /admin page. Recommendations For eClass platform version...

CVE-2019-9886

Any URLs with downloadattachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1...

CVE-2019-9886

Any URLs with downloadattachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1...

Design/Logic Flaw

Any URLs with downloadattachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1...

CVE-2019-9886

CVE-2019-9886 affects BroadLearning eClass up to version ip.2.5.10.2.1, where arbitrary files can be downloaded without authentication via URLs containing download_attachment.php under templates or home folders. Root cause/impact: unauthenticated access to sensitive files (no login required). Pub...

CVE-2019-9886 eClass platform allows user to download arbitrary files without authentication

Any URLs with downloadattachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1...

CVE-2019-9886: Improper Limitation of a Pathname to a Restricted Directory

Any URLs with downloadattachment.php under templates or home folders can allow arbitrary files downloaded without login in BroadLearning eClass before version ip.2.5.10.2.1...

PT-2019-19919

Name of the Vulnerable Software and Affected Versions BroadLearning eClass versions prior to 2.5.10.2.1 Description The issue allows arbitrary files to be downloaded without a login, specifically affecting URLs with "download attachment.php" under templates or home folders. Recommendations For...

Open eClass Cross-Site Scripting Vulnerability

Open eClass formerly known as GUnet eClass is a complete course management system from the Greek company Open eClass. The system supports for storing and presenting educational materials and asynchronous e-learning services, among others. A cross-site scripting vulnerability exists in Open eClass...

GLSA-200803-30 : ssl-cert eclass: Certificate disclosure

The remote host is affected by the vulnerability described in GLSA-200803-30 ssl-cert eclass: Certificate disclosure Robin Johnson reported that the docert function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as srccompile or srcinstall, which will resul...

ssl-cert eclass: Certificate disclosure

Background The ssl-cert eclass is a code module used by Gentoo ebuilds to generate SSL certificates. Description Robin Johnson reported that the docert function provided by ssl-cert.eclass can be called by source building stages of an ebuild, such as srccompile or srcinstall, which will result in...