Student Decrypts Simplocker Android Ransomware that Encrypts Files

In a previous story, I reported about a new ransomware threat known as Simplocker discovered by researchers at the security firm ESET, targeting Android users in the UK, Switzerland, Germany, India and Russia, for ransom. Simplocker Android/Simplocker.A is the latest Android ransomware that has...

Fedora 19 : moodle-2.4.10-1.fc19 (2014-6577)

Moodle upstream has released versions 2.7, 2.6.3, 2.5.6, and 2.4.10 to fix the following security flaws : CVE-2014-0213 MSA-14-0014: Cross-site request forgery possible in Assignment CVE-2014-0214 MSA-14-0015: Web service token expiry issue for MoodleMobile CVE-2014-0215 MSA-14-0016: Anonymous...

CVE-2014-0215

The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote authenticated users to de-anonymize student identities by 1 using a screen reader or 2 reading the HTML source...

CVE-2014-0215

CVE-2014-0215 affects Moodle versions up to 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3. The vulnerability stems from the blind-marking implementation, allowing remote authenticated users to de-anonymize student identities by (1) using a screen reader or (2) reading th...

MGASA-2014-0230 Updated moodle packages fix multiple vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.6.3, Session checking was not being performed correctly in Assignment's quick-grading, allowing forged requests to be made unknowingly by authenticated users CVE-2014-0213. In Moodle before 2.6.3, MoodleMobile web service...

Updated moodle packages fix multiple vulnerabilities

Updated moodle package fixes security vulnerabilities: In Moodle before 2.6.3, Session checking was not being performed correctly in Assignment's quick-grading, allowing forged requests to be made unknowingly by authenticated users CVE-2014-0213. In Moodle before 2.6.3, MoodleMobile web service...

18-Year-Old Student Arrested for Hacking School Computers to Change Grades

An 18-year old Miami University student is facing charges for allegedly breaching the school's computer system to change grades for himself and four other students. Jose Bautista appeared before a judge Friday after he was arrested Thursday by the Miami School Board Police after the principal of...

CVE-2014-1455

Pearson eSIS Enterprise Student Information System (vendor Pearson VUE) is affected by CVE-2014-1455 due to an SQL injection in the password-reset function. The vulnerability involves unsanitized input in the new password being used in an ALTER USER/SQL context, enabling an attacker to execute ar...

CVE-2014-1455: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the password reset functionality in Pearson eSIS Enterprise Student Information System, possibly 3.3.0.13 and earlier, allows remote attackers to execute arbitrary SQL commands via the new password...

Pearson eSIS Enterprise Student Information System XSS

Advisory ID: hag201477 Product: Pearson eSIS Enterprise Student Information System Vendor: PearsonVue Vulnerable Versions: Any version Advisory Publication: April 06, 2014 Vendor Notification: March 05, 2014 Public Disclosure: April 06, 2014 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...

Pearson eSIS 'loginverification.aspx'跨站脚本漏洞

Bugtraq ID:66562 CVE ID:CVE-2014-1942 Pearson eSIS Enterprise Student Information System是一个相关学生信息系统的管理系统。 Pearson eSIS Enterprise Student Information System /aal/loginverification.aspx存在反射型跨站脚本漏洞，允许攻击者构建恶意URI，诱使用户解析，可获取敏感信息或劫持用户会话。 0 Pearson eSIS 目前没有详细解决方案：...

Cross site scripting

Cross-site scripting XSS vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1942

Pearson eSIS Enterprise Student Information System contains a reflected XSS vulnerability in /aal/loginverification.aspx. The issue allows remote attackers to inject arbitrary script via unspecified vectors, potentially affecting the user’s browser context. The publicly available sources identify...

CVE-2014-1942

Cross-site scripting XSS vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-1942: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in aal/loginverification.aspx in Pearson eSIS Enterprise Student Information System allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

强智综合教务系统后台上传漏洞，可沦陷服务器

简要描述： 后台上传获取webshell 通过搜索获得Oracle数据库管理权限 修改成绩 详细说明： http://www.qzdatasoft.com:8088/qznjw/ewebeditor/admin/ 默认账号密码admin 直接上传webshell 获取root权限 （ewebeditor后台授权漏洞修补 目前无法使用ewebeditor后台进行上传） 搜索 oracle.jdbc.driver.OracleDriver 可以获取Oracle数据库账号密码 通过官方PDF文档知晓 成绩保存在CJ0708 补考保存在CJ0708BK 通过近期对服务器信息收集发现...

CVE-2014-1915

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...

CVE-2014-1914

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to inject arbitrary web script or HTML via the 1 topic parameter to sw/addtopic.php or 2 nick parameter to sw/chat/message.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Command School Student Management System 1.06.01 allow remote attackers to hijack the authentication of 1 administrators for requests that change the administrator password via an update action to sw/adminchangepassword.php or 2...