Greymatter gm.cgi HTML injection flaw

The remote host is using Greymatter, an opensource weblogging and journal software written in perl. A vulnerability exists in this version which may allow an attacker to execute arbitrary HTML and script code in the context of the user's browser. OpenVAS Vulnerability Test $Id:...

Greymatter Comment Name Field Control Panel Log XSS

The remote host is using Greymatter, an open source weblogging and journal software written in perl. A vulnerability exists in this version that could allow an attacker to execute arbitrary HTML and script code in the context of the user's browser. %NASLMINLEVEL 70300 C Tenable Network Security,...

CVE-2005-2816

Cross-site scripting XSS vulnerability in Greymatter allows remote attackers to inject arbitrary web script or HTML via a post comment, which is recorded in a log file but not properly handled when the administrator uses "View Control Panel Log" to read the log file...

CVE-2005-2816

Cross-site scripting XSS vulnerability in Greymatter allows remote attackers to inject arbitrary web script or HTML via a post comment, which is recorded in a log file but not properly handled when the administrator uses "View Control Panel Log" to read the log file...

CVE-2005-2816

CVE-2005-2816 describes a Cross-Site Scripting (XSS) vulnerability in Greymatter (Greymatter gm.cgi). The issue occurs when a user submits a post comment that is logged and later read via the administrator’s View Control Panel Log, where the log handling fails to sanitize the injected script/HTML...

CVE-2005-2816: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Greymatter allows remote attackers to inject arbitrary web script or HTML via a post comment, which is recorded in a log file but not properly handled when the administrator uses "View Control Panel Log" to read the log file...

XSS in GreyMatter blog

Graymatter - perl based web blog. offsite: http://www.greymatterforums.com/ GM analyze posting comments and if post contain some dangerous code like script/script, administrator get message about it in log files. Log files contain not only message, but dangerous code. When admin try to look log...

[Full-Disclosure] Kernelpanik Labs Digest 2005-1

Hi and happy new year. This is a email digest with security fails recently published by Kernelpanik Labs http://www.kernelpanik.org Apache suEXEC Bypass -------------------- Small document about how bypass isolating procedures, i.e. suEXEC, in Apache WebServer. English document:...

Greymatter 1.3 Multiple Vulnerabilities

The remote host is running Greymatter, a web-based log and journal maintenance system implemented in Perl. The remote version of this software is vulnerable to an HTML injection attack due to a lack of filtering on user-supplied input in the file 'gm-comments.cgi'. An attacker may exploit this fl...

Greymatter v1.21d: Remote PHP command injection/execution.

Product: Greymatter v1.21d Vendor: Noah Grey - GreySoft Author: FraMe frame at kernelpanik.org URL: http://www.kernelpanik.org CONTENTS 1. Overview 2. Description. 3. How to exploit it? 4. Impact. 5. Patch. 6. Vendor Response 7. Greetings 1. Overview. Greymatter is a news/weblog tool written in...

CVE-2002-0324

Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-.reg file which contains the administrator name and password in cleartext, then retrieving the file from...

CVE-2002-0324

Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-.reg file which contains the administrator name and password in cleartext, then retrieving the file from...

CVE-2002-0324

Greymatter 1.21c and earlier with the Bookmarklet feature enabled is affected. The vulnerability allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-*.reg file that contains the administrator name and password in cleartext...

CVE-2002-0324: Undefined Security Weakness

Greymatter 1.21c and earlier with the Bookmarklet feature enabled allows remote attackers to read a cleartext password and gain administrative privileges by guessing the name of a gmrightclick-.reg file which contains the administrator name and password in cleartext, then retrieving the file from...