CVSS: 2.1EPSS: 0%CPEs: 101EXPL: 2CVE-2012-4238 – TCExam 11.3.007 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2012-4238
Cross-site scripting (XSS) vulnerability in admin/code/tce_edit_answer.php in TCExam before 11.3.008 allows remote authenticated users with level 5 or greater permissions to inject arbitrary web script or HTML via the question_subject_id parameter. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/code/tce_edit_answer.php en TCExam anterior a v11.3.008 permite a usuarios autenticados con nivel 5 o permisos superiores, inyectar código web o HTML arbitrario a través del parámetro question_subject_id. TCExam version 11.3.007 suffers from a cross site scripting vulnerability. • http://archives.neohapsis.com/archives/bugtraq/2012-08/0090.html http://freecode.com/projects/tcexam/releases/347125 http://secunia.com/advisories/50141 http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Bh=edf6e08622642f1b2421f4355d98250d9e1b0742 http://www.reactionpenetrationtesting.co.uk/tcexam-cross-site-scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 101EXPL: 5CVE-2012-4237 – TCExam 11.2.x - '/admin/code/tce_edit_answer.php' Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2012-4237
Multiple SQL injection vulnerabilities in TCExam before 11.3.008 allow remote authenticated users with level 5 or greater permissions to execute arbitrary SQL commands via the subject_module_id parameter to (1) tce_edit_answer.php or (2) tce_edit_question.php. Múltiples vulnerabilidades inyección de código SQL en TCExam anterior a v11.3.008 permite a usuarios remotos autenticados con nivel 5 o permisos superiores ejecutar comandos SQL arbitrarios a través del parámetro subject_module_id en (1) tce_edit_answer.php o (2) tce_edit_question.php. TCExam Edit version 11.3.007 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/37584 https://www.exploit-db.com/exploits/37585 http://archives.neohapsis.com/archives/bugtraq/2012-08/0079.html http://freecode.com/projects/tcexam/releases/347125 http://secunia.com/advisories/50141 http://tcexam.git.sourceforge.net/git/gitweb.cgi?p=tcexam/tcexam%3Bh=edf6e08622642f1b2421f4355d98250d9e1b0742 http://www.openwall.com/lists/oss-security/2012/08/13/8 http://www.reactionpenetrationtesting.co.uk/tcexam-sql-injection.html http://www.securityfocus. • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2007-6288
https://notcve.org/view.php?id=CVE-2007-6288
Multiple SQL injection vulnerabilities in TCExam before 5.1.000 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Múltiples vulnerabilidades de inyección SQL en TCExam versiones anteriores a 5.1.000 permiten a atacantes remotos ejecutar comandos SQL de su elección mediante vectores no especificados. • http://secunia.com/advisories/27940 http://sourceforge.net/project/shownotes.php?release_id=559646&group_id=159398 http://www.securityfocus.com/bid/26760 https://exchange.xforce.ibmcloud.com/vulnerabilities/38920 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 1CVE-2007-2431 – TCExam 4.0.011 - 'SessionUserLang' Shell Injection
https://notcve.org/view.php?id=CVE-2007-2431
Dynamic variable evaluation vulnerability in shared/config/tce_config.php in TCExam 4.0.011 and earlier allows remote attackers to conduct cross-site scripting (XSS) and possibly other attacks by modifying critical variables such as $_SERVER, as demonstrated by injecting web script via the _SERVER[SCRIPT_NAME] parameter. Vulnerabilidad de evaluación de variable dinámica en shared/config/tce_config.php en TCExam 4.0.011 y anteriores permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados (XSS) y posiblemente otros ataques modificando variables críticas como $_SERVER, como ha sido demostrado inyectando secuencias de comandos web mediante el parámetro _SERVER[SCRIPT_NAME]. • https://www.exploit-db.com/exploits/3816 http://secunia.com/advisories/25008 http://sourceforge.net/forum/forum.php?forum_id=690912 http://www.attrition.org/pipermail/vim/2007-May/001572.html http://www.securityfocus.com/bid/23704 https://exchange.xforce.ibmcloud.com/vulnerabilities/33957 •
CVSS: 7.8EPSS: 2%CPEs: 1EXPL: 1CVE-2007-2430 – TCExam 4.0.011 - 'SessionUserLang' Shell Injection
https://notcve.org/view.php?id=CVE-2007-2430
shared/code/tce_tmx.php in TCExam 4.0.011 and earlier allows remote attackers to create arbitrary PHP files in cache/ by placing file contents and directory traversal manipulations into a SessionUserLang cookie to public/code/index.php. shared/code/tce_tmx.php en TCExam 4.0.011 y anteriores permite a atacantes remotos crear ficheros PHP de su elección en cache/ poniendo contenidos y manipulaciones de cruce de directorios en una cookie SessionUserLang a public/code/index.php. • https://www.exploit-db.com/exploits/3816 http://secunia.com/advisories/25008 http://sourceforge.net/forum/forum.php?forum_id=690912 http://www.attrition.org/pipermail/vim/2007-May/001571.html http://www.securityfocus.com/bid/23705 http://www.vupen.com/english/advisories/2007/1583 https://exchange.xforce.ibmcloud.com/vulnerabilities/33958 •