GForge help/tracker.php helpname Parameter XSS

The installed version of GForge fails to sanitize user-supplied input to the 'helpname' parameter in the 'help/tracker.php' script before using it to generate dynamic HTML content. An unauthenticated, remote attacker may be able to leverage this issue to inject arbitrary HTML or script code into ...

[SECURITY] [DSA 1937-1] New gforge packages fix cross-site scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1937-1 [email protected] http://www.debian.org/security/ Steffen Joeris November 21, 2009 http://www.debian.org/security/faq -...

Sql injection

SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2009-3303

Cross-site scripting XSS vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter...

CVE-2009-4070

SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2009-3303

Cross-site scripting XSS vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4069

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4070

SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2009-4069

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-3303

CVE-2009-3303 affects GForge and its help/tracker.php script. Versions 4.5.14, 4.7 rc2, and 4.8.1 are vulnerable to a cross-site scripting (XSS) flaw via the helpname parameter due to insufficient input sanitising. The issue allows remote attackers to inject arbitrary HTML/script content into a u...

CVE-2009-3303

Cross-site scripting XSS vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter...

CVE-2009-4069

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-4070

CVE-2009-4070 describes a SQL injection in GForge versions such as 4.5.14 and 4.7.3 (and possibly others). Remote attackers could execute arbitrary SQL commands via unknown vectors. The connected Red Hat, Debian, and Ubuntu entries corroborate the vulnerability in GForge and note the need for upd...

CVE-2009-4069

CVE-2009-4069 affects GForge, with multiple cross-site scripting (XSS) vulnerabilities reported in at least GForge 4.5.14 and 4.7.3 (and possibly other versions). Attackers can inject arbitrary web script or HTML via unspecified vectors. The Red Hat, Debian, and Ubuntu entries reiterate XSS issue...

CVE-2009-4070

SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2009-3303: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter...

CVE-2009-4070: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors...

CVE-2009-4069: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...