CVE-2024-51743 Arbitrary File Write leading up to remote code execution (instructor accounts)

MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the update/upload/create file methods in Controllers allows authenticated instructors to write arbitrary files to any location on the web server...

CVE-2024-47820

MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this...

CVE-2024-47820 MarkUs vulnerable to Path Traversal

MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this...

CVE-2024-47820 MarkUs vulnerable to Path Traversal

MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this...

PT-2024-32832

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.4.8 Description The issue affects MarkUs, a web application for the submission and grading of student assignments. It is vulnerable to path traversal, allowing authenticated instructors to download any file on the we...

CVE-2024-47820: Improper Limitation of a Pathname to a Restricted Directory

MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8. Authenticated instructors may download any file on the web server MarkUs is running on, depending on the file permissions. MarkUs v2.4.8 has addressed this...

PT-2024-35382 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab version 3.0.1 Description: The issue concerns an HTML injection vulnerability that can affect instructors and CAs on the grade submissions page. This vulnerability is patched in version 3.0.2. Recommendations: For Autolab version 3.0....

PT-2024-34876

Name of the Vulnerable Software and Affected Versions MarkUs versions prior to 2.4.8 Description The issue is related to an arbitrary file write vulnerability in the update/upload/create file methods in Controllers, allowing authenticated instructors to write arbitrary files to any location on th...

Autolab cross-site scripting vulnerabilities

Autolab is an open source course management service from Autolab. It supports automatically graded programming assignments. A cross-site scripting vulnerability exists in Autolab version 3.0.1, which stems from the presence of an HTML injection vulnerability that could affect instructors and CAs ...

WordPress Tutor LMS plugin <= 2.7.1 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion vulnerability

Authenticated Instructor+ Insecure Direct Object Reference to Arbitrary Quiz Attempt Deletion vulnerability discovered by Thanh Nam Tran in WordPress Plugin Tutor LMS versions = 2.7.1...

CVE-2024-4279

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference to Arbitrary Course Deletion in versions up to, and including, 2.7.0 via the 'tutorcoursedelete' function due to missing validation on a user controlled key. This can allow...

WordPress Tutor LMS plugin <= 2.7.0 - Authenticated (Instructor+) Insecure Direct Object Reference to Arbitrary Course Deletion vulnerability

Authenticated Instructor+ Insecure Direct Object Reference to Arbitrary Course Deletion vulnerability discovered by Thanh Nam Tran in WordPress Plugin Tutor LMS versions = 2.7.0...

CVE-2024-4397

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'savepostmaterials' function in versions up to, and including, 4.2.6.5. This makes it possible for authenticated attackers, with Instructor-level permissio...

PT-2024-18067 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.3 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the Course, Lesson, and Quiz title and...

Path traversal

Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform...

CVE-2023-44395 Autolab has Path Traversal vulnerability in Assessment functionality

Autolab is a course management service that enables instructors to offer autograded programming assignments to their students over the Web. Path traversal vulnerabilities were discovered in Autolab's assessment functionality in versions of Autolab prior to 2.12.0, whereby instructors can perform...

PT-2023-23725 · Autolab · Autolab

Name of the Vulnerable Software and Affected Versions: Autolab versions prior to 2.11.0 Description: A Tar slip vulnerability was found in the MOSS cheat checker functionality of Autolab, which is a course management service for auto-graded programming assignments. To exploit this issue, an...

This 9-Course Bundle Can Take Your Cybersecurity Skills to the Next Level

If you regularly read The Hacker News, there's a fair chance that you know something about cybersecurity. It's possible to turn that interest into a six-figure career. But to make the leap, you need to pick up some key skills and professional certifications. Featuring nine in-depth courses, The...

Sourcecodester Online Event Booking and Reservation System SQL Injection Vulnerability

Sourcecodester Online Event Booking and Reservation System is developed using PHP, MySQL database, HTML, CSS, Javascript, Bootstrap and AdminLTE. The system can be accessed by three types of users, namely system administrators, students, and instructors. sourcecodester Online Event Booking and...

Learn Ethical Hacking From Scratch — 18 Online Courses for Just $43

If you're reading this post, there is a pretty good chance you're interested in hacking. Ever thought about turning it into a career? The cybersecurity industry is booming right now, and ethical hacking is one of the most lucrative and challenging niches. It's open to anyone with the right skills...