Directory traversal

Multiple directory traversal vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to 1 read portions of arbitrary files via a .. dot dot and a ..\ dot dot backslash in the lang parameter to main/exercice/hotspotlangconversion.php and 2 read arbitrary files via a .. dot do...

CVE-2009-2009: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dokeos 1.8.5, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 curdirpath parameter to main/document/slideshow.php and the 2 file parameter to main/exercice/testheaderpage.php...