3916 matches found
Cisco Prime LAN Management Solution Default Decryption Key Vulnerability
A vulnerability in Cisco Prime LAN Management Solution LMS could allow an authenticated, local attacker to decrypt and access data fields in LMS databases that are used to manage devices in Cisco networks. The vulnerability is due to the presence of a default database decryption key that is share...
ATutor LMS - install_modules.php Cross-Site Request Forgery / Remote Code Execution
Exploit for php platform in category web applications / exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/2016 - notified vendor via...
ATutor LMS - install_modules.php Cross-Site Request Forgery Remote Code Execution
ATutor LMS - installmodules.php Cross-Site Request Forgery Remote Code Execution / exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/20...
ATutor LMS - '/install_modules.php' Cross-Site Request Forgery / Remote Code Execution
/ exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/2016 - notified vendor via infoatatutordotca 24/02/2016 - requested CVE and assigne...
ATutor LMS 2.2.1 CSRF Remote Code Execution
/ exp.js ATutor LMS " in it - You will need to set the Access-Control-Allow-Origin header to allow the target to pull zips - Use this with your favorite XSS attack - Student proof, aka bullet proof Timeline: 23/02/2016 - notified vendor via infoatatutordotca 24/02/2016 - requested CVE and assigne...
SRC-2016-0016 : ATutor LMS password_reminder ‘UPDATE’ Type Juggling Authentication Bypass Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to bypass the authentication mechanism on vulnerable installations of ATutor. The specific flaw exists in the ‘passwordreminder.php’ script when performing an password reset. The code uses a loose comparison when comparing the...
SRC-2016-0012 : ATutor LMS confirm ‘UPDATE’ Type Juggling Authentication Bypass Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to bypass the authentication mechanism on vulnerable installations of ATutor. The specific flaw exists in the ‘confirm.php’ script when updating a members email address. The code uses a loose comparison when comparing the supplied...
SRC-2016-0004 : ATutor LMS SocialGroups search SQL Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...
SRC-2016-0007 : ATutor LMS searchFriends SQL Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is not required to exploit this vulnerability. The specific flaw exists in the searchFriends function within the ‘friends.inc.php’ script. An attacker...
SRC-2016-0003 : ATutor LMS PhotoAlbum search SQL Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...
SRC-2016-0005 : ATutor LMS searchMembers SQL Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...
SRC-2016-0006 : ATutor LMS updateAdditionalInformation SQL Injection Remote Code Execution Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ATutor. Authentication is required to exploit this vulnerability however authentication bypass vulnerabilities are known and remote registration is open by default. The...
SRC-2016-0000 : ATutor LMS login_functions.inc.php Password Hash Usage Authentication Bypass Vulnerability
Vulnerability Details: This vulnerability allows remote attackers to bypass authentication on vulnerable installations of ATutor. User interaction is not required to exploit this vulnerability. The specific flaw exists within the handling of challenges for authentication. The implementation of th...
Chamilo LMS IDOR - messageId Delete POST Injection
Chamilo LMS IDOR - messageId Delete POST Injection Document Title: =============== Chamilo LMS IDOR - messageId Delete POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1720 Video: https://www.youtube.com/watch?v=3ApPhUIk12Y Relea...
Chamilo LMS - Persistent Cross-Site Scripting
Chamilo LMS - Persistent Cross-Site Scripting Document Title: =============== Chamilo LMS - Persistent Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1727 Video: https://www.youtube.com/watch?v=gNZsQjmtiGI Release Dat...
Chamilo LMS - Persistent Cross-Site Scripting
Exploit for php platform in category web applications Document Title: =============== Chamilo LMS - Persistent Cross Site Scripting Vulnerability Video: https://www.youtube.com/watch?v=gNZsQjmtiGI Product & Service Introduction: =============================== Chamilo is an open-source under...
Chamilo LMS IDOR - 'messageId' Delete POST Injection
Document Title: =============== Chamilo LMS IDOR - messageId Delete POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1720 Video: https://www.youtube.com/watch?v=3ApPhUIk12Y Release Date: ============= 2016-02-15 Vulnerability...
Chamilo LMS - Persistent Cross-Site Scripting
Document Title: =============== Chamilo LMS - Persistent Cross Site Scripting Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1727 Video: https://www.youtube.com/watch?v=gNZsQjmtiGI Release Date: ============= 2016-02-17 Vulnerability...
Chamilo LMS Cross Site Scripting
Document Title: =============== Chamilo LMS - Persistent Cross Site Scripting Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id= Video: https://www.youtube.com/watch?v=gNZsQjmtiGI Release Date: ============= 2016-02-17 Vulnerability Laborator...
Chamilo LMS Insecure Direct Object Reference
Document Title: =============== Chamilo LMS IDOR - messageId Delete POST Inject Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1720 Video: https://www.youtube.com/watch?v=3ApPhUIk12Y Release Date: ============= 2016-02-15 Vulnerability...