Filtered by vendor Ilias
Subscriptions
Total
35 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-33528 | 1 Ilias | 1 Ilias | 2024-11-04 | 4.7 Medium |
| A Stored Cross-site Scripting (XSS) vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload. | ||||
| CVE-2022-31266 | 1 Ilias | 1 Ilias | 2024-11-04 | 4.3 Medium |
| In ILIAS through 7.10, lack of verification when changing an email address (on the Profile Page) allows remote attackers to take over accounts. | ||||
| CVE-2017-15538 | 1 Ilias | 1 Ilias | 2024-09-17 | N/A |
| Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php. | ||||
| CVE-2018-10665 | 1 Ilias | 1 Ilias | 2024-09-16 | N/A |
| ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files. | ||||
| CVE-2023-45869 | 1 Ilias | 1 Ilias | 2024-09-12 | 9 Critical |
| ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system. | ||||
| CVE-2023-45867 | 1 Ilias | 1 Ilias | 2024-09-12 | 6.5 Medium |
| ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a privileged account, typically holding the tutor role, can exploit this to gain unauthorized access to and potentially retrieve confidential files stored on the web server. The attacker can access files that are readable by the web server user www-data; this may include sensitive configuration files and documents located outside the documentRoot. The vulnerability is exploited by an attacker who manipulates the file parameter in a URL, inserting directory traversal sequences in order to access unauthorized files. This manipulation allows the attacker to retrieve sensitive files, such as /etc/passwd, potentially compromising the system's security. This issue poses a significant risk to confidentiality and is remotely exploitable over the internet. | ||||
| CVE-2007-5806 | 1 Ilias | 1 Ilias | 2024-08-07 | N/A |
| Cross-site scripting (XSS) vulnerability in Services/Utilities/classes/class.ilUtil.php in ILIAS 3.8.3 and earlier allows remote attackers to inject arbitrary web script or HTML via attributes inside a domain-name string in the (1) mailing or (2) forum component, as demonstrated using the style and onmouseover HTML attributes. | ||||
| CVE-2008-5816 | 1 Ilias | 1 Ilias | 2024-08-07 | N/A |
| SQL injection vulnerability in repository.php in ILIAS 3.7.4 and earlier allows remote attackers to execute arbitrary SQL commands via the ref_id parameter. | ||||
| CVE-2014-2089 | 1 Ilias | 1 Ilias | 2024-08-06 | N/A |
| ILIAS 4.4.1 allows remote attackers to execute arbitrary PHP code via an e-mail attachment that leads to creation of a .php file with a certain client_id pathname. | ||||
| CVE-2014-2088 | 1 Ilias | 1 Ilias | 2024-08-06 | N/A |
| Unrestricted file upload vulnerability in ilias.php in ILIAS 4.4.1 allows remote authenticated users to execute arbitrary PHP code by using a .php filename in an upload_files action to the uploadFiles command, and then accessing the .php file via a direct request to a certain client_id pathname. | ||||
| CVE-2014-2090 | 1 Ilias | 1 Ilias | 2024-08-06 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter. | ||||
| CVE-2017-7583 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| ILIAS before 5.2.3 has XSS via SVG documents. | ||||
| CVE-2018-11117 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute. | ||||
| CVE-2018-11119 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter. | ||||
| CVE-2018-11118 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php. | ||||
| CVE-2018-11120 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS. | ||||
| CVE-2018-10307 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception. | ||||
| CVE-2018-10428 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| ILIAS before 5.1.26, 5.2.x before 5.2.15, and 5.3.x before 5.3.4, due to inconsistencies in parameter handling, is vulnerable to various instances of reflected cross-site-scripting. | ||||
| CVE-2018-10306 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid date. | ||||
| CVE-2018-5688 | 1 Ilias | 1 Ilias | 2024-08-05 | N/A |
| ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component. | ||||