272 matches found
CVE-2007-0246
plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATHINFO...
CVE-2007-0246
plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATHINFO...
CVE-2007-0246
CVE-2007-0246 affects GForge’s CVSWeb CGI (plugins/scmcvs/www/cvsweb.php) running with CVSWeb in GForge 4.5.16 prior to 20070524. The vulnerability arises from insufficient sanitization of PATH_INFO, allowing remote attackers to inject shell metacharacters and execute arbitrary commands. Reported...
CVE-2007-0246: Undefined Security Weakness
plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATHINFO...
GForge CVSWeb CGI cvsweb.php PATH_INFO Parameter Arbitrary Command Execution
The remote host is running GForge, a web-based project for collaborative software development. The version of GForge installed on the remote host fails to sanitize user-supplied input to the 'plugins/scmcvs/cvsweb.php' script before using it to execute a shell command. An unauthenticated attacker...
Debian DSA-1297-1 : gforge-plugin-scmcvs - missing input sanitising
Bernhard R. Link discovered that the CVS browsing interface of Gforge, a collaborative development tool, performs insufficient escaping of URLs, which allows the execution of arbitrary shell commands with the privileges of the www-data user. The oldstable distribution sarge is not affected by thi...
[SECURITY] [DSA 1297-1] New gforge-plugin-scmcvs packages fix arbitrary shell command execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1297-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 24th, 2007 http://www.debian.org/security/faq -...
[SECURITY] [DSA 1297-1] New gforge-plugin-scmcvs packages fix arbitrary shell command execution
-------------------------------------------------------------------------- Debian Security Advisory DSA 1297-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 24th, 2007 http://www.debian.org/security/faq -...
DSA-1297-1 gforge-plugin-scmcvs
Bulletin has no description...
CVE-2007-0176
Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...
CVE-2007-0176
Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...
CVE-2007-0176
Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...
CVE-2007-0176: Undefined Security Weakness
Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...
CVE-2007-0176
GForge contains a cross-site scripting (XSS) vulnerability in search/advanced_search.php (words parameter) affecting version 4.5.11 (and related builds). The flaw allows remote injection of arbitrary scripts/HTML in the context of a logged-in user. Debian DSAs note a fix in 4.5.14 (and related up...
GForge Cross Site Scripting vulnerability
GForge Cross Site Scripting vulnerability Version: Tested on GForge 4.5.11 Discovered by: Jose Ramon Palanco: jose.palancoateazeldotes http://www.eazel.es Description: GForge is vulnerable to a security vulnerability that allow Cross-Site Scripting attacks. Due to improper filtering, a remote...
Debian DSA-1094-1 : gforge - missing input sanitising
Joxean Koret discovered several cross-site scripting vulnerabilities in Gforge, an online collaboration suite for software development, which allow injection of web script code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
[SECURITY] [DSA 1094-1] New gforge packages fix cross-site scripting
-------------------------------------------------------------------------- Debian Security Advisory DSA 1094-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 8th, 2006 http://www.debian.org/security/faq -...