863 matches found
DEBIAN-CVE-2009-4459
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...
CVE-2009-4459
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...
Cross site scripting
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...
CVE-2009-4459
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...
CVE-2009-4459
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...
CVE-2009-4459
The CVE-2009-4459 issue affects Redmine 0.8.7 and earlier, where the title tag is defined before the character encoding meta tag. This allows XSS via UTF-7 encoded values in the title parameter on a new issue page, potentially interpreted as script by Internet Explorer 7/8. Debian backports show ...
CVE-2009-4459
Redmine 0.8.7 and earlier uses the title tag before defining the character encoding in a meta tag, which allows remote attackers to conduct cross-site scripting XSS attacks and inject arbitrary script via UTF-7 encoded values in the title parameter to a new issue page, which may be interpreted as...
Redmine 0.8.7 UTF-7 Cross Site Scripting
Redmine prior to . Thus it may be possible to create a page with encoded to UTF-7 JavaScript in title and it will be executed in Internet Explorer 7/8 with Auto-Select encoding on Proof-of-Concept: 1. Create new issue with title "+ADw-script+AD4-alert'XSS';+ADw-/script+AD4-" without quotes 2. Ope...
Redmine <= 0.8.7 UTF-7 XSS Vulnerability
No description provided by source. Redmine = 0.8.7 UTF-7 XSS Vulnerability Discovered by: p0deje http://p0deje.blogspot.com Application: http://www.redmine.org/wiki/redmine/Download SA: - Date: 01.12.2009 Versions affected: = 0.8.7 Vulnerability: Cross-site Scripting Platform: Ruby Ruby On Rails...
Ruby on Rails 'protect_from_forgery'跨站脚本请求伪造漏洞
Bugraq ID: 37322 CVE ID：CVE-2009-4136 Ruby on Rails是一款Web应用程序框架，构建在Ruby语言之上。 Ruby on Rails 'protectfromforgery'存在跨站请求伪造攻击，远程攻击者可以利用漏洞执行部分管理员操作，获得对应用程序的未授权访问或删除部分数据。 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails...
Redmine 0.8.6 Cross Site Request Forgery
view source print? / Redmine document.getEleme...
Redmine 0.8.6 - Cross-Site Request Forgery (Add Admin)
Redmine 0.8.6 - Cross-Site Request Forgery Add Admin / Redmine...
Redmine <= 0.8.6 CSRF Add Admin User Exploit
No description provided by source. / Redmine = 0.8.6 CSRF Add Admin User Exploit Discovered by: p0deje http://p0deje.blogspot.com Application: http://www.redmine.org/wiki/redmine/Download SA: http://www.redmine.org/news/30 Date: 13.11.2009 Versions affected: = 0.8.6 Vulnerability: Cross-site...
Redmine <= 0.8.6 CSRF Add Admin User Exploit
Exploit for unknown platform in category web applications ============================================ Redmine input style="display: none" type="checkbox" value="1" name="us...
Redmine 0.8.6 - Cross-Site Request Forgery (Add Admin)
/ Redmine input style="display: none" type="submit" valu...
Ruby on Rails 2.3.5 - 'protect_from_forgery' Cross-Site Request Forgery
source: https://www.securityfocus.com/bid/37322/info Ruby on Rails is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions, gain unauthorized access to the affected application, or delete certain data. Oth...
CVE-2009-4079
Cross-site request forgery CSRF vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the authentication of users for requests that delete a ticket via unspecified vectors...
CVE-2009-4079
Cross-site request forgery CSRF vulnerability in Redmine 0.8.5 and earlier allows remote attackers to hijack the authentication of users for requests that delete a ticket via unspecified vectors...