Vulnerabilities for Blackboard learn (...) - CXSECURITY.COM

Vulnerabilities for 'Blackboard learn'

2021-07-20

CVE-2021-36746

CWE-79

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.

CVE-2021-36747

CWE-79

Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.

2020-02-25

CVE-2020-9008

CWE-79

Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor.

2019-11-18

CVE-2018-13257

CWE-601

The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing attack from the CAS server login page.

2018-04-30

CVE-2017-18262

CWE-601

Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI.

>>> Vendor: Blackboard 11 Products

Blackboard learning and community post systems

Blackboard academic suite

Blackboard learning and community portal suite

Blackboard learn

Collaborate ultra

Copyright 2024, cxsecurity.com