Geeklog 1.3.7 - 'comment.php?cid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/6603/info Geeklog is prone to a cross-site scripting vulnerability in the 'comment.php' script. This issue is due to insufficient sanitization of input submitted in URI parameters. As a result, an attacker may create a malicious link to a site hosting...

CVE-2002-1917

CRLF injection vulnerability in the "User Profile: Send Email" feature in Geeklog 1.35 and 1.3.5sr1 allows remote attackers to obtain e-mail addresses by injecting a CRLF into the Subject field and adding a BCC mail header...

CVE-2002-0962

Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via 1 the url variable in the Link field of a calendar event, 2 the topic parameter in index.php, or 3 the title parameter in comment.php...

CVE-2002-0963

SQL injection vulnerability in comment.php for GeekLog 1.3.5 and earlier allows remote attackers to obtain sensitive user information via the pid parameter...

CVE-2002-0962

CVE-2002-0962 corresponds to a cross-site scripting vulnerability in GeekLog 1.3.5 and earlier. The connected Nessus entry links this CVE to GeekLog

CVE-2002-0963

CVE-2002-0963 describes a SQL injection in GeekLog 1.3.5 and earlier, occurring in comment.php via the pid parameter. This could allow remote attackers to obtain sensitive user information. The NVD notes a MEDIUM risk (CVSS v2: AV:N/AC:L/Au:N/C:P/I:N/A:N; base 5.0). Affected product/version and e...

CVE-2002-0962

Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via 1 the url variable in the Link field of a calendar event, 2 the topic parameter in index.php, or 3 the title parameter in comment.php...

CVE-2002-0963

SQL injection vulnerability in comment.php for GeekLog 1.3.5 and earlier allows remote attackers to obtain sensitive user information via the pid parameter...

CVE-2002-0963: Undefined Security Weakness

SQL injection vulnerability in comment.php for GeekLog 1.3.5 and earlier allows remote attackers to obtain sensitive user information via the pid parameter...

CVE-2002-0962: Undefined Security Weakness

Cross-site scripting vulnerabilities in GeekLog 1.3.5 and earlier allow remote attackers to execute arbitrary script via 1 the url variable in the Link field of a calendar event, 2 the topic parameter in index.php, or 3 the title parameter in comment.php...

Geeklog XSS and CRLF Injection

Geeklog XSS and CRLF Injection PROGRAM: Geeklog VENDOR: Tony Bibbs et al. [email protected] HOMEPAGE: http://geeklog.sourceforge.net/ VULNERABLE VERSIONS: 1.3.5sr1, possibly earlier versions as well NOT VULNERABLE VERSIONS: 1.3.5sr2 LOGIN REQUIRED: no SEVERITY: high DESCRIPTION:...

Geeklog 1.3.5 - HTML Attribute Cross-Site Scripting

Geeklog 1.3.5 - HTML Attribute Cross-Site Scripting source: https://www.securityfocus.com/bid/5270/info A cross site scripting vulnerability has been reported for Geeklog. Reportedly, Geeklog does not properly sanitize user supplied input before being included when posting comments or writing...

Geeklog 1.3.5 - HTML Attribute Cross-Site Scripting

source: https://www.securityfocus.com/bid/5270/info A cross site scripting vulnerability has been reported for Geeklog. Reportedly, Geeklog does not properly sanitize user supplied input before being included when posting comments or writing stories. Geeklog makes efforts to sanitize some malicio...

CVE-2002-0097

Geeklog 1.3 allows remote attackers to hijack user accounts, including the administrator account, by modifying the UID of a user's permanent cookie to the target account...

CVE-2002-0097

CVE-2002-0097 affects Geeklog 1.3, where remote attackers can hijack user accounts (including the administrator) by modifying a user’s permanent cookie UID to the target account. The root cause is manipulating the UID in the persistent cookie to assume another user’s session. The available connec...

CVE-2002-0096

The installation of Geeklog 1.3 creates an extra groupassignments record which is not properly deleted, which causes the first newly created user to be added to the GroupAdmin and UserAdmin groups, which could provide that user with administrative privileges that were not intended...

CVE-2002-0096

The CVE-2002-0096 entry concerns Geeklog 1.3. The installation process creates an extra group_assignments record that is not deleted, causing the first newly created user to be added to the GroupAdmin and UserAdmin groups and potentially receive unintended administrative privileges. Connected sou...

CVE-2002-0097: Undefined Security Weakness

Geeklog 1.3 allows remote attackers to hijack user accounts, including the administrator account, by modifying the UID of a user's permanent cookie to the target account...

CVE-2002-0096: Undefined Security Weakness

The installation of Geeklog 1.3 creates an extra groupassignments record which is not properly deleted, which causes the first newly created user to be added to the GroupAdmin and UserAdmin groups, which could provide that user with administrative privileges that were not intended...

[ARL02-A13] Multiple Security Issues in GeekLog

+/---------------- ALPER Research Labs ------/--------/+ +/---------------- Security Advisory -----/---------/+ +/---------------- ID: ARL02-A13 ----/----------/+ +/---------------- [email protected] ---/-----------/+ Advisory Information -------------------- Name : Multiple Security Issues in...