245 matches found
CVE-2006-5791
Removed by vendor...
CVE-2006-5790
The CVE-2006-5790 issue affects elog (web-based electronic logbook) up to version 2.6.2 and earlier, with multiple format-string vulnerabilities in elogd.c (and related vectors in functions such as el_submit, receive_config, show_rss_feed, show_elog_list, show_logbook_node, server_loop) that coul...
CVE-2006-5791
Multiple cross-site scripting XSS vulnerabilities in elogd.c in ELOG 2.6.2 and earlier allow remote attackers to inject arbitrary HTML or web script via 1 the filename for downloading, which is not quoted in an error message by the sendfiledirect function, and 2 the Type or Category values in a N...
CVE-2006-5791
CVE-2006-5791 affects the elog web-based logbook (ELOG 2.6.2 and earlier). The vulnerability arises from cross-site scripting in elogd.c, specifically via the download filename in send_file_direct and the Type/Category fields in New entries, allowing remote attackers to inject arbitrary HTML/scri...
CVE-2006-5790
Multiple format string vulnerabilities in elogd.c in ELOG 2.6.2 and earlier allow remote attackers to cause a denial of service crash and possibly execute arbitrary code via 1 an entry with an attachment whose name contains format string specifiers elsubmit function, and possibly other vectors in...
Debian DSA-967-1 : elog - several vulnerabilities
Several security problems have been found in elog, an electronic logbook to manage notes. The Common Vulnerabilities and Exposures Project identifies the following problems : - CVE-2005-4439 'GroundZero Security' discovered that elog insufficiently checks the size of a buffer used for processing...
CVE-2006-5063
Cross-site scripting XSS vulnerability in Elog 2.6.1 allows remote attackers to inject arbitrary web script or HTML by editing log entries in HTML mode...
CVE-2006-5063
Cross-site scripting XSS vulnerability in Elog 2.6.1 allows remote attackers to inject arbitrary web script or HTML by editing log entries in HTML mode...
CVE-2006-5063
CVE-2006-5063 is an XSS vulnerability in elog (web-based logbook), where editing log entries in HTML mode allows remote attackers to inject script/HTML. Affected: elog; root cause: HTML editing path lacks proper input sanitization. Impact: client-side script execution that can compromise user ses...
CVE-2006-5063
Removed by vendor...
CVE-2006-0600
elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service infinite redirection via a request with the fail parameter set to 1, which redirects to the same request...
CVE-2006-0599
The 1 elog.c and 2 elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames...
Stack overflow
Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service application crash and possibly execute code via long "revision attributes"...
CVE-2006-0597
Multiple stack-based buffer overflows in elogd.c in elog before 2.5.7 r1558-4 allow attackers to cause a denial of service application crash and possibly execute code via long "revision attributes"...
CVE-2006-0598
Buffer overflow in elogd.c in elog before 2.5.7 r1558-4 allows attackers to execute code via unspecified variables, when writing to the log file...
Cross site request forgery (csrf)
elog before 2.5.7 r1558-4 allows remote attackers to cause a denial of service infinite redirection via a request with the fail parameter set to 1, which redirects to the same request...
CVE-2006-0600
CVE-2006-0600 affects elog, a logbook app. The issue is an input handling flaw in the fail parameter that can trigger an infinite redirect, enabling denial of service. Debian’s DSA-967-1 and OpenVAS notes confirm the vulnerability and list affected versions; fixes were released as elog 2.5.7+r155...
CVE-2006-0599
The 1 elog.c and 2 elogd.c components in elog before 2.5.7 r1558-4 generate different responses depending on whether or not a username is valid, which allows remote attackers to determine valid usernames...