Claroline

Claroline

31 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2022-37162

Exploit
  • EPSS 0.38%
  • Veröffentlicht 25.08.2022 17:15:08
  • Zuletzt bearbeitet 21.11.2024 07:14:32

Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.

6.1

CVE-2022-37161

Exploit
  • EPSS 0.25%
  • Veröffentlicht 25.08.2022 17:15:08
  • Zuletzt bearbeitet 21.11.2024 07:14:32

Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.

5.4

CVE-2022-37160

Exploit
  • EPSS 0.26%
  • Veröffentlicht 25.08.2022 17:15:08
  • Zuletzt bearbeitet 21.11.2024 07:14:32

Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is p...

9.8

CVE-2022-37159

Exploit
  • EPSS 3.38%
  • Veröffentlicht 25.08.2022 17:15:08
  • Zuletzt bearbeitet 21.11.2024 07:14:32

Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.

3.5

CVE-2013-4753

Exploit
  • EPSS 0.16%
  • Veröffentlicht 26.12.2014 23:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.11.9 and earlier allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field in an inbox action to messaging/messagebox.php, (2) the "First name" ...

4.3

CVE-2013-6267

Exploit
  • EPSS 0.52%
  • Veröffentlicht 05.12.2013 18:55:12
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML via the (1) box parameter to messaging/messagebox.php, cidToEdit parameter to (2) adminregisteruser.php or (3...

5

CVE-2011-3716

Exploit
  • EPSS 0.28%
  • Veröffentlicht 23.09.2011 23:55:02
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Claroline 1.9.7 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by work/connector/linker.cnr.php and certain other files.

4.3

CVE-2009-1907

Exploit
  • EPSS 2.76%
  • Veröffentlicht 04.06.2009 16:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in claroline/linker/notfound.php in Claroline 1.8.11 allows remote attackers to inject arbitrary web script or HTML via the Referer HTTP header.

4.3

CVE-2008-3315

Exploit
  • EPSS 2.34%
  • Veröffentlicht 25.07.2008 16:41:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the (1) query string to (a) announcements/messages.php; (b) lostPassword.php and (c) profile.php in auth/; (d) c...

5.8

CVE-2008-3262

  • EPSS 0.25%
  • Veröffentlicht 22.07.2008 17:41:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Cross-site request forgery (CSRF) vulnerability in Claroline before 1.8.10 allows remote attackers to change passwords, related to lack of a requirement for the previous password.