CVE-2017-15214

Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges and also to execute JavaScript against other users including unauthenticated users, via the name, title, or id parameter to...

CVE-2017-15213

Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via the realname or emailaddress field to themes/CleanFS/templates/common.editallusers.tpl...

CVE-2017-15214

Flyspray 1.0-rc4 through 1.0-rc6 contains a stored XSS vulnerability. An authenticated user can inject JavaScript via the name, title, or id parameter in plugins/dokuwiki/lib/plugins/changelinks/syntax.php to execute code with administrator privileges or to target other users (including unauthent...

CVE-2017-15213

Flyspray is affected by a stored cross-site scripting vulnerability (CVE-2017-15213) in versions before 1.0-rc6. An authenticated user can inject JavaScript via the real_name or email_address fields in themes/CleanFS/templates/common.editallusers.tpl to gain administrator privileges. Affected pro...

[ASA-201710-13] flyspray: cross-site scripting

Arch Linux Security Advisory ASA-201710-13 ========================================== Severity: High Date : 2017-10-10 CVE-ID : CVE-2017-15213 CVE-2017-15214 Package : flyspray Type : cross-site scripting Remote : Yes Link : https://security.archlinux.org/AVG-439 Summary ======= The package...

Flyspray Cross-Site Scripting Vulnerability

Flyspray is a web-based bug tracking system software. A cross-site scripting vulnerability exists in Flyspray version 1.0-rc4. An attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Flyspray 1.0-rc4 Cross Site Scripting

HTTPCS Advisory : HTTPCS160 Product : Flyspray Version : 1.0-rc4 Date : 2017-04-24 Criticality level : Less Critical Description : A vulnerability has been discovered in Flyspray , which can be exploited by malicious people to conduct cross-site scripting attacks. Input passed via the 'realname'...

FlySpray 1.0-rc4 - Cross-Site Scripting Cross-Site Request Forgery

FlySpray 1.0-rc4 - Cross-Site Scripting Cross-Site Request Forgery Exploit Title: XSRF Stored FlySpray 1.0-rc4 XSS2CSRF add admin account Date: 19/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org Version: 1.0-rc4 Tested on: Windows 7 x64 SP1 / Kali Linux...

FlySpray 1.0-rc4 - Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities

Exploit for php platform in category web applications Exploit Title: XSRF Stored FlySpray 1.0-rc4 XSS2CSRF add admin account Date: 19/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org Version: 1.0-rc4 Tested on: Windows 7 x64 SP1 / Kali Linux Description : A...

FlySpray 1.0-rc4 - Cross-Site Scripting / Cross-Site Request Forgery

Exploit Title: XSRF Stored FlySpray 1.0-rc4 XSS2CSRF add admin account Date: 19/04/2017 Exploit Author: Cyril Vallicari / HTTPCS / ZIWIT : https://www.openoffice.org Version: 1.0-rc4 Tested on: Windows 7 x64 SP1 / Kali Linux Description : A vulnerability has been discovered in Flyspray , which ca...

Flyspray 0.9 - Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/15209/info Flyspray is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. An attacker may leverage this issue to have arbitrary script cod...

Flyspray 0.9.9 - Information Disclosure, HTML Injection, and Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/28076/info Flyspray is prone to an information-disclosure issue, an HTML-injection issue, and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may levera...

Flyspray 0.9.9 Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/26891/info Flyspray is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browse...

Flyspray 0.9.9.6 CSRF Vulnerability

No description provided by source. Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability Date: 06 Feb 2012 Author: Vaibhav Gupta Software Link: http://flyspray.org/flyspray-0.9.9.6.zip Version: 0.9.9.6 +---+CSRF Add Admin Account after authentication+---+ html body...

CVE-2012-1058

Cross-site request forgery CSRF vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php...

CVE-2012-1058

Summary: CVE-2012-1058 is a CSRF vulnerability in Flyspray 0.9.9.6 that allows remote attackers to hijack admin authentication by triggering admin.newuser actions on index.php to add new admin accounts. What is affected: Flyspray 0.9.9.6. The connected documents describe the vulnerability as CSRF...

CVE-2012-1058

Cross-site request forgery CSRF vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php...

Flyspray 0.9.9.6 CSRF Vulnerability

Exploit for php platform in category web applications Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability Date: 06 Feb 2012 Author: Vaibhav Gupta Software Link: http://flyspray.org/flyspray-0.9.9.6.zip Version: 0.9.9.6 +---+CSRF Add Admin Account after authentication+---+ CSRF Exploit to add ADMIN...

Flyspray 0.9.9.6 - Cross-Site Request Forgery

Flyspray 0.9.9.6 - Cross-Site Request Forgery Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability Date: 06 Feb 2012 Author: Vaibhav Gupta Software Link: http://flyspray.org/flyspray-0.9.9.6.zip Version: 0.9.9.6 +---+CSRF Add Admin Account after authentication+---+ CSRF Exploit to add ADMIN account...