Vulnerabilities
7 CVEs · NVD, GitHub Advisories, CISA KEV, FIRST EPSS, GitHub PoC repos
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-39196 | Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/ Blackboard Learn 1.10.1 allows remote authenticated users to read unintended files by entering student credentials and then directly visiting a certain webapps/bbcms/execute/ URL. Note: The vendor disputes this stating this cannot be reproduced. NVD description · AI analysis pending | 6.5 | 1% | PoC |
| — | |
| CVE-2021-36747 +1 in the same advisory: …36746 | Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form. NVD description · AI analysis pending | 5.4 | <1% | PoC |
| — | |
| CVE-2020-25902 | Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. Blackboard Collaborate Ultra 20.02 is affected by a cross-site scripting (XSS) vulnerability. The XSS payload will execute on the class room, which leads to stealing cookies from users who join the class. NOTE: Third-parties dispute the validity of this entry as a possible false positive during research NVD description · AI analysis pending | 6.1 | <1% |
| — | ||
| CVE-2020-9008 | Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the Peopl Stored Cross-site scripting (XSS) vulnerability in Blackboard Learn/PeopleTool v9.1 allows users to inject arbitrary web script via the Tile widget in the People Tool profile editor. NVD description · AI analysis pending | 5.4 | <1% | PoC |
| — | |
| CVE-2018-13257 | The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Serv The bb-auth-provider-cas authentication module within Blackboard Learn 2018-07-02 is susceptible to HTTP host header spoofing during Central Authentication Service (CAS) service ticket validation, enabling a phishing attack from the CAS server login page. NVD description · AI analysis pending | 6.1 | 1% | PoC |
| — | |
| CVE-2017-18262 | Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth log Blackboard Learn (Since at least 17th of October 2017) has allowed Unvalidated Redirects on any signed-in user through its endpoints for handling Shibboleth logins, as demonstrated by a webapps/bb-auth-provider-shibboleth-BBLEARN/execute/shibbolethLogin?returnUrl= URI. NVD description · AI analysis pending | 6.1 | 1% |
| — |