CVE-2012-2380

CVE-2012-2380 affects the Apache Roller project, specifically the admin/editor console. The issue is that HTTP POST interfaces in the Roller admin/editor console were not protected against CSRF, allowing remote attackers to hijack admin/editor authentication. Affected versions include Roller 4.0....

PT-2012-3996

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.1 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console. These vulnerabilities allow remote attackers to hijack the authentication of admins or...

CVE-2012-2380: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the admin/editor console in Apache Roller before 5.0.1 allow remote attackers to hijack the authentication of admins or editors by leveraging the HTTP POST functionality...

CVE-2012-2381: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Apache Roller before 5.0.1 allow remote authenticated users to inject arbitrary web script or HTML by leveraging the blogger role...

PT-2012-3997

Name of the Vulnerable Software and Affected Versions Apache Roller versions prior to 5.0.1 Description The issue allows remote authenticated users to inject arbitrary web script or HTML, leveraging the blogger role. This is due to multiple cross-site scripting XSS vulnerabilities. Recommendation...

The Cadence of Microsoft Security Patches

By Andrew Storms Every month, like clockwork, Microsoft releases security bulletins and every month people ask me if it’s small or a big release. While the exact details of the patches are generally treated as news, the expected workload each month really shouldn’t be a guessing game because...

apache roller 4.0 跨站脚本

No description provided by source...

Apache Roller 'q' Parameter Cross Site Scripting Vulnerability

This host is running Apache Roller and is prone to Cross Site Scripting vulnerability. OpenVAS Vulnerability Test $Id: gbapacherollerxssvulnaug09.nasl 4865 2016-12-28 16:16:43Z teissa $ Apache Roller 'q' Parameter Cross Site Scripting Vulnerability Authors: Antu Sanadi Copyright: Copyright c 2009...

Apache Roller Detection (HTTP)

HTTP based detection of Apache Roller. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.800677";...

Apache Roller 2.x < 4.0.1 XSS Vulnerability

Apache Roller is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:roller...

Cross site scripting

Cross-site scripting XSS vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action...

CVE-2008-6879

Cross-site scripting XSS vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action...

CVE-2008-6879

CVE-2008-6879 affects Apache Roller 2.3, 3.0, 3.1, and 4.0. The vulnerability is a Cross-Site Scripting (XSS) flaw caused by insufficient sanitization of the q parameter in search actions, allowing injection of arbitrary web script/HTML. Concrete details available in connected docs include produc...

CVE-2008-6879

Cross-site scripting XSS vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action...

CVE-2008-6879: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Apache Roller 2.3, 3.0, 3.1, and 4.0 allows remote attackers to inject arbitrary web script or HTML via the q parameter in a search action...

MDKA-2007:050 : shared-mime-info

A misconfiguration in the default application priorities was causing file-roller an archive manager to be used by default for ISO image files, instead of nautilus-cd-burner, for the GNOME desktop environment. This bug has been fixed with an updated shared-mime-info package, which also contains...

Mandriva Update for shared-mime-info MDKA-2007:050 (shared-mime-info)

Check for the Version of shared-mime-info OpenVAS Vulnerability Test Mandriva Update for shared-mime-info MDKA-2007:050 shared-mime-info Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribut...

Apache Roller q Parameter XSS

The remote host is running Apache Roller, a multi-user blog server written in Java. The version of Apache Roller installed on the remote host fails to sanitize user input to the 'q' parameter of search requests before including it in dynamic HTML output. An attacker may be able to leverage this...

Apache Roller q参数跨站脚本漏洞

BUGTRAQ ID: 33110 Apache Roller是一个多用户的群组Blog服务器。 如果通过q参数值向Roller服务器提交了特制的搜索请求（/search?q=query+terms）的话，服务器未经转义HTML标签便在默认的搜索表单中回显查询请求，这可能导致跨站脚本攻击。 Apache Apache Roller 4.0 Apache Apache Roller 3.1 Apache Apache Roller 3.0 Apache Apache Roller 2.3 厂商补丁： Apache ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下...

Roller Weblogger contains a cross-site scripting vulnerability

Overview A cross-site scripting vulnerability in Roller Weblogger may allow an attacker to read or modify data in web pages and cookies. Description There is a cross-site scripting vulnerability in the way that Roller handles data supplied in the comments section of a web page running the Roller...