eFront 3.6.15 Path Traversal

eFront 3.6.15 Path Traversal Vulnerability + Author: Filippo Roncari + Target: eFront + Version: 3.6.15 and probably lower + Vendor: www.efrontlearning.net + Accessibility: Remote + Severity: High + CVE: + Full Advisory: https://www.securenetwork.it/docs/advisory/SN-15-02eFront.pdf + Info:...

Chamilo LMS 1.9.10 - Multiple Vulnerabilities

Exploit for php platform in category web applications I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain...

Chamilo LMS 1.9.10 Cross Site Request Forgery / Cross Site Scripting Vulnerabilities

Chamilo LMS versions 1.9.10 and below suffer from cross site request forgery and cross site scripting vulnerabilities. I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF...

Chamilo LMS 1.9.10 - Multiple Vulnerabilities

Chamilo LMS 1.9.10 - Multiple Vulnerabilities I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control...

Chamilo LMS 1.9.10 Cross Site Request Forgery / Cross Site Scripting

I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control over valid user accounts in LMS, perform...

Chamilo LMS 1.9.10 - Multiple Vulnerabilities

I. Overview ======================================================== Chamilo LMS 1.9.10 or prior versions are prone to a multiple Cross-Site Scripting Stored + Reflected & CSRF vulnerabilities. These vulnerabilities allows an attacker to gain control over valid user accounts in LMS, perform...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution LMS and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and...

Chamilo LMS 1.9.8 Blind SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection Date: 06-12-2014 Software Link: http://www.chamilo.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1...

Chamilo LMS 1.9.8 - Blind SQL Injection

Chamilo LMS 1.9.8 - Blind SQL Injection Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection Date: 06-12-2014 Software Link: http://www.chamilo.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description...

Chamilo LMS 1.9.8 Blind SQL Injection

Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection Date: 06-12-2014 Software Link: http://www.chamilo.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Database::escapestring function is used to...

Chamilo LMS 1.9.8 - Blind SQL Injection

Exploit Title: Chamilo LMS 1.9.8 Blind SQL Injection Date: 06-12-2014 Software Link: http://www.chamilo.org/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Database::escapestring function is used to...

Two Reflected Cross-Site Scripting (XSS) Vulnerabilities in Forma Lms

Advisory ID: HTB23226 Product: Forma Lms Vendor: http://www.formalms.org/ Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Advisory Publication: August 6, 2014 without technical details Vendor Notification: August 6, 2014 Vendor Patch: November 4, 2014 Public Disclosure: Novemb...

CVE-2014-5257

Multiple cross-site scripting XSS vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the 1 idcustom parameter in an amanmenu request or 2 idgame parameter in an alms/games/edit request to appCore/index.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the 1 idcustom parameter in an amanmenu request or 2 idgame parameter in an alms/games/edit request to appCore/index.php...

CVE-2014-5257

Multiple cross-site scripting XSS vulnerabilities in Forma Lms before 1.2.1 p01 allow remote attackers to inject arbitrary web script or HTML via the 1 idcustom parameter in an amanmenu request or 2 idgame parameter in an alms/games/edit request to appCore/index.php...

CVE-2014-5257

CVE-2014-5257 affects Forma Lms prior to 1.2.1 p01, with two reflected XSS vulnerabilities in appCore/index.php exploitable via id_custom (amanmenu) and id_game (alms/games/edit). Advisory HTB23226 describes insufficient sanitization leading to arbitrary HTML/script execution in the context of a ...

Forma Lms 1.2.1 Cross Site Scripting

Advisory ID: HTB23226 Product: Forma Lms Vendor: http://www.formalms.org/ Vulnerable Versions: 1.2.1 and probably prior Tested Version: 1.2.1 Advisory Publication: August 6, 2014 without technical details Vendor Notification: August 6, 2014 Vendor Patch: November 4, 2014 Public Disclosure: Novemb...

Two Reflected Cross-Site Scripting (XSS) Vulnerabilities in Forma Lms

High-Tech Bridge Security Research Lab discovered two vulnerabilities in Forma Lms, which can be exploited to perform Cross-Site Scripting XSS attacks against vulnerable website. 1 Reflected Cross-Site Scripting XSS in Forma Lms: CVE-2014-5257 1.1 The vulnerability exists due to insufficient...

Chamilo LMS 1.9.6 (profile.php, password0 param) - SQL Injection

No description provided by source...

Dokeos LMS <= 1.8.5 (include) Remote Code Execution Exploit

No description provided by source. !/usr/bin/perl Dokeos LMS = 1.8.5 include Remote Code Execution Exploit Description --------------------------------------------------------------- Dokeos LMS contains one flaw that allows an attacker to include a local file with html extension. The issue is due...