CVE-2013-3636

CVE-2013-3636 affects ProjectPier 0.8.8, describing a remote information disclosure caused by session cookies lacking the HttpOnly flag. Multiple connected sources (NVD, Red Hat, CVE lists, etc.) confirm the weakness and its impact (cookie-based information disclosure) without detailing a patch. ...

CVE-2013-3636

ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag...

CVE-2013-3635

CVE-2013-3635 affects ProjectPier 0.8.8. The vulnerability is a stored cross-site scripting (XSS) flaw in the application, with the XSS payloads reported in fields such as Contact Name, Contact Company Name, and Contact Description. Multiple connected sources corroborate that this vulnerability c...

CVE-2013-3635

ProjectPier 0.8.8 has stored XSS...

PT-2020-7457

Name of the Vulnerable Software and Affected Versions: ProjectPier version 0.8.8 Description: The issue is related to a Remote Information Disclosure Weakness due to the lack of the HttpOnly cookie flag. Recommendations: For ProjectPier version 0.8.8, consider setting the HttpOnly cookie flag to...

PT-2020-7456

Name of the Vulnerable Software and Affected Versions: ProjectPier version 0.8.8 Description: The issue is related to stored XSS. Recommendations: For ProjectPier version 0.8.8, update to a version that includes a fix for this issue...

PT-2020-7458

Name of the Vulnerable Software and Affected Versions: ProjectPier version 0.8.8 Description: The issue is related to the insecure use of cookies. ProjectPier 0.8.8 does not set the Secure flag for cookies, which could potentially expose sensitive information. Recommendations: For ProjectPier...

CVE-2013-3637: Improper Neutralization of Input During Web Page Generation

ProjectPier 0.8.8 does not use the Secure flag for cookies...

CVE-2013-3636: Improper Neutralization of Input During Web Page Generation

ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag...

ProjectPier Unlimited File Upload Vulnerability

ProjectPier is a free open source project management system . Files plugin is one of the file management plugin . An arbitrary file upload vulnerability exists in ProjectPier 0.88 and previous versions of the Files plugin. A remote attacker can exploit this vulnerability to execute arbitrary PHP...

Unrestricted file upload

Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document...

CVE-2018-10760

Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document...

CVE-2018-10760

Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document...

CVE-2018-10760

CVE-2018-10760 describes an unrestricted file upload vulnerability in ProjectPier's Files plugin (versions 0.88 and earlier). The issue allows remote authenticated users to upload a file with an executable extension and then access it via a direct request to the file in the tmp directory under th...

CVE-2018-10760

Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document...

CVE-2018-10760: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document...

PT-2018-10089

Name of the Vulnerable Software and Affected Versions ProjectPier versions 0.88 and earlier Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directo...

ProjectPier 0.8.8 SQL Injection / Authentication Bypass / RFI Vulnerabilities

ProjectPier versions 0.8.8 and below suffer from remote file inclusion, authentication bypass, remote shell upload, and remote SQL injection vulnerabilities. "ProjectPier is a Free, Open-Source, PHP application for managing tasks, projects and teams through an intuitive web interface."...

ProjectPier 0.8.8 SQL Injection / Authentication Bypass / RFI

"ProjectPier is a Free, Open-Source, PHP application for managing tasks, projects and teams through an intuitive web interface." https://github.com/Project-Pier https://sourceforge.net/projects/projectpier/ I reached out to the vendor via several channels to report the findings below, but receive...

CVE-2015-2796

Multiple cross-site scripting XSS vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the searchfor parameter to 1 searchbytag.php, 2 searchcontacts.php, or 3 search.php...