Blackboard
by Blackboard
CVEs (9)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-51367 | Cri | 0.64 | 9.8 | 0.01 | Nov 21, 2024 | An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file. | ||
| CVE-2017-18262 | Med | 0.40 | 6.1 | 0.01 | Apr 30, 2018 | Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI. | ||
| CVE-2021-36747 | Med | 0.35 | 5.4 | 0.01 | Jul 20, 2021 | Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. | ||
| CVE-2021-36746 | Med | 0.35 | 5.4 | 0.01 | Jul 20, 2021 | Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor. | ||
| CVE-2006-4308 | 0.03 | — | 0.02 | Aug 23, 2006 | Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite 6.2.3.23, and Blackboard Vista 4 allow remote attackers to inject arbitrary Javascript, VBScript, or HTML via (1) data, (2) vbscript, and (3)… | |||
| CVE-2002-1007 | 0.03 | — | 0.03 | Oct 4, 2002 | Cross-site scripting vulnerabilities in Blackboard 5 allow remote attackers to execute arbitrary web script via (1) the course_id parameter in a link to login.pl, (2) the CTID parameter in ProcessInfo.cgi, or (3) the Message parameter in index.cgi. | |||
| CVE-2006-0511 | 0.00 | — | 0.00 | Feb 1, 2006 | Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that "This is a… | |||
| CVE-2004-1582 | 0.00 | — | 0.02 | Dec 31, 2004 | PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using… | |||
| CVE-2004-1581 | 0.00 | — | 0.01 | Dec 31, 2004 | BlackBoard 1.5.1 allows remote attackers to gain sensitive information via a direct request to (1) checkdb.inc.php, (2) admin.inc.php or (3) cp.inc.php, which reveals the path in a PHP error message. |
- risk 0.64cvss 9.8epss 0.01
An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file.
- risk 0.40cvss 6.1epss 0.01
Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI.
- risk 0.35cvss 5.4epss 0.01
Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.
- risk 0.35cvss 5.4epss 0.01
Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.
- CVE-2006-4308Aug 23, 2006risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in Blackboard Learning System 6, Blackboard Learning and Community Portal Suite 6.2.3.23, and Blackboard Vista 4 allow remote attackers to inject arbitrary Javascript, VBScript, or HTML via (1) data, (2) vbscript, and (3)…
- CVE-2002-1007Oct 4, 2002risk 0.03cvss —epss 0.03
Cross-site scripting vulnerabilities in Blackboard 5 allow remote attackers to execute arbitrary web script via (1) the course_id parameter in a link to login.pl, (2) the CTID parameter in ProcessInfo.cgi, or (3) the Message parameter in index.cgi.
- CVE-2006-0511Feb 1, 2006risk 0.00cvss —epss 0.00
Blackboard Academic Suite 6.0 and earlier does not properly clear session information when de-authenticating a user who is idle, which allows subsequent users to log in as the previous user and gain privileges. NOTE: the vendor has disputed this issue, saying that "This is a…
- CVE-2004-1582Dec 31, 2004risk 0.00cvss —epss 0.02
PHP remote file inclusion vulnerability in BlackBoard 1.5.1 allows remote attackers to execute arbitrary PHP code by modifying the libpath parameter (incorrectly called "libpach") to reference a URL on a remote web server that contains _more.php, as demonstrated using…
- CVE-2004-1581Dec 31, 2004risk 0.00cvss —epss 0.01
BlackBoard 1.5.1 allows remote attackers to gain sensitive information via a direct request to (1) checkdb.inc.php, (2) admin.inc.php or (3) cp.inc.php, which reveals the path in a PHP error message.