Golestan System Of Iran SQL Injection

In The Name Of God Exploit Title : Golestan System Of Iran Login Bypass Vulnerability Exploit Author : 4TT4CK3R Tested on : Internet Explorer , Kali Linux , Windows 8.1 HomePage : https://reg.pnu.ac.ir Vendor Page : https://reg1.pnu.ac.ir/forms/authenticateuser/main.htm Thanks to : Behrooz...

Banner Student Product URL Redirection Vulnerability

Banner Student is used to query and manage student records and information. A URL redirection vulnerability exists in the Banner Student product, which can be exploited by an attacker to redirect to a malicious page...

Department of Education Lambasted Over Database Vulnerabilities

Like the Office of Personnel Management before it, the Department of Education has failed to heed repeated warnings that its systems contain multiple weaknesses. In a House Committee on Oversight and Government Reform hearing held this week, Congressman and committee chair Jason Chaffetz R-Utah...

src.ac.uk XSS vulnerability

Vulnerable URL: http://www.src.ac.uk/student-life/134-courses/part-time-courses/engineering-skills/641-recreational-welding? Details: Description| Value ---|--- Patched:| Yes, at 30.01.2016 Latest check for patch:| 30.01.2016 22:42 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

The vulnerability of the Moodle learning management system allows a perpetrator to gain access to protected information.

The vulnerability of the Moodle learning management system’s sub-component, lib/navigationlib.php, is related to the lack of protection for operational data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to protected information using the student...

This 20-year-old Student Has Written 100 Malware Programs in Two Years

Security firm Trend Micro has identified a 20-year-old Brazilian college student responsible for developing and distributing over 100 Banking Trojans selling each for around US$300. Known online as 'Lordfenix', 'Hacker's Son' and 'Filho de Hacker', the computer science student first began his...

Moodle 'mod/quiz/report/statistics/statistics_question_table.php' cross-site scripting vulnerability

Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in the Moodle 'mod/quiz/report/statistics/statisticsquestiontable.php' script. A remote...

Design/Logic Flaw

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

UBUNTU-CVE-2015-2273

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...

CVE-2015-2273

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...

CVE-2015-3180: Exposure of Sensitive Information to an Unauthorized Actor

lib/navigationlib.php in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allows remote authenticated users to obtain sensitive course-structure information by leveraging access to a student account with a suspended enrolment...

CVE-2015-2273: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mod/quiz/report/statistics/statisticsquestiontable.php in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the student role for a...

某通用型大学生管理系统SQL注入

简要描述： RT 详细说明： 注入链接： /zhanshikebiao.aspx?centid= 案例： http://syjx.njxzc.edu.cn/zhanshikebiao.aspx?centid=799&date=2013-12-20&xyid= http://lab.njnu.edu.cn/dkysy/zhanshikebiao.aspx?centid=23&date=2013-12-13&xyid= http://coalab.njupt.edu.cn/nykzsy/zhanshikebiao.aspx?centid=702&date=2015-3-21&xyid=...

某用户量较大的综合管理系统mssql注射漏洞

简要描述： 大量学生综合系统使用安脉的。 详细说明： 厂商： 上海安脉计算机科技有限公司 http://www.anmai.net/ SQL注射点： /oa/news/updateAffiche.aspx?id=1 其中id参数存在sql注射 互联网自动采集案例5枚： http://zhgl.w25z.cn/ANMAI/oa/news/updateAffiche.aspx?id=1 http://www.jukui.com/ANMAI/oa/news/updateAffiche.aspx?id=1...

某校园系统一处遗漏通用SQL注入漏洞

简要描述： 校园系统通用SQL注入 详细说明： 漏洞细节： 见乌云，URL： WooYun: 某通用型校园校务系统SQL注入 属于遗漏一处： 漏洞位置在学生成绩查询处的输入处 位置：SM2005/student/StuCJ/StuScoreQuery.asp?sYanzheng=suyaxingweb 注入参数：StartKSID 借用前人案例：...

某通用型校园系统多处系统越权

简要描述： 见详情 详细说明： 漏洞证明： 看乌云别人提交，看了下： 关键字：SM2005/ 多处越权： 第一处：无需登陆可查看任意教师，任意学期的班级课表 漏洞位置：SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingweb 案例如下： http://www.sdwhys.com/SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingweb http://www.zjnksyzx.com:8801/SM2005/student/StuKB/TeaKB.asp?sYanzheng=suyaxingw...

White House Creates Cyber Governance Unit Within OMB

With the framework explained for a number of government cybersecurity-related initiatives, now it’s time to talk money. The White House anted up strong in 2015 with proposals for a new data breach notification standard, as well as plans to facilitate information-sharing between the public and...

CVE-2014-7831

lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...

CVE-2014-7831: Exposure of Sensitive Information to an Unauthorized Actor

lib/classes/gradesexternal.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the getgrades web service...

Mozilla.org Cross Site Scripting

Domains: http://lxr.mozilla.org/ http://mxr.mozilla.org/ The two domains above are almost the same Websites information: lxr.mozilla.org, mxr.mozilla.org are cross references designed to display the Mozilla source code. The sources displayed are those that are currently checked in to the mainline...