Vulnerabilities > Claroline

DATE CVE VULNERABILITY TITLE RISK
2007-09-05 CVE-2007-4718 Path Traversal vulnerability in Claroline
Directory traversal vulnerability in inc/lib/language.lib.php in Claroline before 1.8.6 allows remote attackers to include and execute arbitrary local files via a ..
network
high complexity
claroline CWE-22
5.1
2007-09-05 CVE-2007-4717 Cross-Site Scripting vulnerability in Claroline
Multiple cross-site scripting (XSS) vulnerabilities in Claroline before 1.8.6 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) dir parameter in admin/adminusers.php, the (2) action parameter in admin/advancedUserSearch.php, and the (3) view parameter in admin/campusProblem.php.
network
claroline CWE-79
3.5
2007-07-03 CVE-2007-3517 Cross-Site Scripting vulnerability in Claroline 1.8.3
Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.8.3 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF) to (1) index.php, (2) demo/claroline170/index.php, and possibly other scripts.
network
claroline
4.3
2007-02-24 CVE-2006-7048 Remote Security vulnerability in Claroline 1.7.5
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter to (a) atutor.inc.php (b) db-generic.inc.php (c) docebo.inc.php (d) dokeos.1.6.inc.php (e) dokeos.inc.php (f) ganesha.inc.php (g) mambo.inc.php (h) moodle.inc.php (i) phpnuke.inc.php (j) postnuke.inc.php and (k) spip.inc.php in claroline/auth/extauth/drivers/; (2) includePath parameter in mambo.inc.php, postnuke.inc.php, and (l) inc/lib/event/init_event_manager.inc.php; and (3) rootSys parameter in (m) inc/lib/export_exe_tracking.class.php, a different set of vectors than CVE-2006-2284.
network
low complexity
claroline
7.5
2006-10-12 CVE-2006-5256 Remote File Include vulnerability in Claroline Import.lib.PHP
PHP remote file inclusion vulnerability in claroline/inc/lib/import.lib.php in Claroline 1.8.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter.
network
low complexity
claroline
7.5
2006-09-19 CVE-2006-4844 Code Injection vulnerability in multiple products
PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.
network
high complexity
claroline dokeos CWE-94
5.1
2006-06-28 CVE-2006-3257 Cross-Site Scripting vulnerability in Claroline 1.7.7
Multiple cross-site scripting (XSS) vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including (1) calendar/myagenda.php, (2) document/document.php, (3) phpbb/newtopic.php, (4) tracking/userLog.php, and (5) wiki/page.php.
network
claroline
4.3
2006-06-06 CVE-2006-2868 Remote File Include vulnerability in Claroline 1.7.6
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.6 allow remote attackers to execute arbitrary PHP code via a URL in the includePath cookie to (1) auth/extauth/drivers/mambo.inc.php or (2) auth/extauth/drivers/postnuke.inc.php.
network
high complexity
claroline
5.1
2006-05-10 CVE-2006-2284 Remote File Include vulnerability in Claroline
Multiple PHP remote file inclusion vulnerabilities in Claroline 1.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) clarolineRepositorySys parameter in ldap.inc.php and the (2) claro_CasLibPath parameter in casProcess.inc.php.
network
claroline dokeos
6.8
2006-04-03 CVE-2006-1596 Unspecified vulnerability in Claroline
PHP remote file inclusion vulnerability in learnPath/include/scormExport.inc.php in Claroline 1.7.4 and earlier allows remote attackers to execute arbitrary PHP code via the includePath parameter.
network
low complexity
claroline
7.5