Vulnerabilities > Ilias
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-05-18 | CVE-2018-10306 | Cross-site Scripting vulnerability in Ilias Services/Form/classes/class.ilDateDurationInputGUI.php and Services/Form/classes/class.ilDateTimeInputGUI.php in ILIAS 5.1.x through 5.3.x before 5.3.4 allow XSS via an invalid date. | 4.3 |
| 2018-05-17 | CVE-2018-11120 | Cross-site Scripting vulnerability in Ilias Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS. | 4.3 |
| 2018-05-17 | CVE-2018-11119 | Open Redirect vulnerability in Ilias ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 redirects a logged-in user to a third-party site via the return_to_url parameter. | 5.8 |
| 2018-05-17 | CVE-2018-11118 | Cross-site Scripting vulnerability in Ilias The RSS subsystem in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a URI to Services/Feeds/classes/class.ilExternalFeedItem.php. | 4.3 |
| 2018-05-17 | CVE-2018-11117 | Cross-site Scripting vulnerability in Ilias Services/Feeds/classes/class.ilExternalFeedItem.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS via a link attribute. | 4.3 |
| 2018-05-02 | CVE-2018-10665 | Cross-site Scripting vulnerability in Ilias 5.3.4 ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files. | 4.3 |
| 2018-01-14 | CVE-2018-5688 | Cross-site Scripting vulnerability in Ilias ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component. | 4.3 |
| 2017-10-17 | CVE-2017-15538 | Cross-site Scripting vulnerability in Ilias Stored XSS vulnerability in the Media Objects component of ILIAS before 5.1.21 and 5.2.x before 5.2.9 allows an authenticated user to inject JavaScript to gain administrator privileges, related to the setParameter function in Services/MediaObjects/classes/class.ilMediaItem.php. | 3.5 |
| 2017-04-07 | CVE-2017-7583 | Cross-site Scripting vulnerability in Ilias ILIAS before 5.2.3 has XSS via SVG documents. | 4.3 |
| 2014-03-02 | CVE-2014-2090 | Cross-Site Scripting vulnerability in Ilias 4.4.1 Multiple cross-site scripting (XSS) vulnerabilities in ilias.php in ILIAS 4.4.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) tar, (2) tar_val, or (3) title parameter. | 3.5 |