CVE-2015-2796

Multiple cross-site scripting XSS vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the searchfor parameter to 1 searchbytag.php, 2 searchcontacts.php, or 3 search.php...

CVE-2015-2796

Project-Pier ProjectPier-Core is affected by multiple XSS vulnerabilities in the search functionality. The issue arises from the search_for parameter being unsafely echoed by three pages: search_by_tag.php, search_contacts.php, and search.php, enabling remote attackers to inject arbitrary web scr...

CVE-2015-2796: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the searchfor parameter to 1 searchbytag.php, 2 searchcontacts.php, or 3 search.php...

PT-2018-4368

Name of the Vulnerable Software and Affected Versions ProjectPier-Core affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters...

ProjectPier 0.8 Multiple HTML Injection and Cross-Site Scripting Vulnerabilities

No description provided by source. source: http://www.securityfocus.com/bid/27857/info ProjectPier is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...

Re: Project Pier Web Vulnerabilities

Mitre has assigned the following CVE's for these issues in Project Pier: XSS: CVE-2013-3635 Session cookies lack HttpOnly flag: CVE-2013-3636 Session cookies lack Secure flag: CVE-2013-3637 On Tue, May 21, 2013 at 9:26 PM, the infinitenigma [email protected] wrote: Summary...

Project Pier 0.8.8 XSS / Insecure Cookies

Summary -------------------- Software : ProjectPier Version : 0.8.8 other versions untested Website : http://www.projectpier.org Issue : XSS stored, Insecure Cookie storage CVSS Base : AV:N/AC:M/Au:S/C:C/I:C/A:N CVSS Score: 7.9 Researcher: Carl Benedict Product Description --------------------...

ProjectPier 0.8.8 Shell Upload

Exploit for php platform in category web applications ProjectPier 0 echo $FILES"file""error" . " " . $FILES"file""name" . " " . $FILES"file""tmpname"; else $folder = rtrim './upload/' . $POST'folder' , '/'; @mkdir$folder, 0777, true; $seq = strpadint $POST"part",4,"0",STRPADLEFT;...

ProjectPier 0.8.8 Shell Upload

ProjectPier 0 echo $FILES"file""error" . " " . $FILES"file""name" . " " . $FILES"file""tmpname"; else $folder = rtrim './upload/' . $POST'folder' , '/'; @mkdir$folder, 0777, true; $seq = strpadint $POST"part",4,"0",STRPADLEFT; moveuploadedfile$FILES"file""tmpname", $folder . '/'...

CVE-2011-3797

ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files...

Information disclosure

ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files...

CVE-2011-3797

ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files...

CVE-2011-3797: Exposure of Sensitive Information to an Unauthorized Actor

ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files...

PT-2011-4687

Name of the Vulnerable Software and Affected Versions ProjectPier version 0.8.0.3 Description The issue allows remote attackers to obtain sensitive information via a direct request to certain .php files, which reveals the installation path in an error message. This can be demonstrated by requesti...

CVE-2011-3797

ProjectPier 0.8.0.3 is affected. The vulnerability stems from an information-disclosure flaw where a direct request to a PHP file (e.g., public/upgrade/templates/layout.php) can reveal the installation path in an error message. This is a remote issue that permits an attacker to obtain sensitive f...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 a message, 2 a milestone, or 3 a display name in a profile, or the 4 a or 5 c parameter to index.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via the query string, as demonstrated by a delete project action...

CVE-2008-5583

Cross-site request forgery CSRF vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via the query string, as demonstrated by a delete project action...

CVE-2008-5584

Multiple cross-site scripting XSS vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 a message, 2 a milestone, or 3 a display name in a profile, or the 4 a or 5 c parameter to index.php...

CVE-2008-5583

Cross-site request forgery CSRF vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via the query string, as demonstrated by a delete project action...