263 matches found
User avatar upload endpoint is vulnerable to XSRF
Stash, as 2.12, will allows users to upload local avatars to their account STASHDEV-6182. That upload is submitted to a non-API end point that accepts a POST request with the avatar as data-uri|https://en.wikipedia.org/wiki/DataUri. Currently, because the form is submitted by AJAX, the end point ...
User avatar upload endpoint is vulnerable to XSRF
Stash, as 2.12, will allows users to upload local avatars to their account STASHDEV-6182. That upload is submitted to a non-API end point that accepts a POST request with the avatar as data-uri|https://en.wikipedia.org/wiki/DataUri. Currently, because the form is submitted by AJAX, the end point ...
Privilege escalation
We have identified and fixed a vulnerability in Stash which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Stash web interface. The Stash server is only vulnerable if it has been...
Privilege escalation
We have identified and fixed a vulnerability in Stash which allowed unauthenticated users to commit actions on behalf of any other authorised user. In order to exploit this vulnerability, an attacker requires access to your Stash web interface. The Stash server is only vulnerable if it has been...
Able to create a repository from Source Tree on a Stash project on which i do not have 'admin' access
Able to create a repository from Source Tree on a Stash project on which i do not have 'admin' access. On Stash, only admin access will have option to create repositories, however Source Tree allows users to create repository on a Stash project where users have only 'write' access. This is a majo...
Able to create a repository from Source Tree on a Stash project on which i do not have 'admin' access
Able to create a repository from Source Tree on a Stash project on which i do not have 'admin' access. On Stash, only admin access will have option to create repositories, however Source Tree allows users to create repository on a Stash project where users have only 'write' access. This is a majo...
Upgrade bundled Tomcat due to security vulnerabilities
There are some Tomcat security vulnerabilities reported against the bundled version 7.0.32: CVE-2013-2067|http://mail-archives.apache.org/modmbox/www-announce/201305.mbox/%[email protected]%3E...
Upgrade bundled Tomcat due to security vulnerabilities
There are some Tomcat security vulnerabilities reported against the bundled version 7.0.32: CVE-2013-2067|http://mail-archives.apache.org/modmbox/www-announce/201305.mbox/%[email protected]%3E...
Persistent Cross Site Scripting Vulnerability
We have identified and fixed a persistent cross-site scripting XSS vulnerabilities that affects Stash instances, including publicly available instances that is, Internet-facing servers. XSS vulnerabilities allow an attacker to embed their own JavaScript into a Stash page. More information is...
Persistent Cross Site Scripting Vulnerability
We have identified and fixed a persistent cross-site scripting XSS vulnerabilities that affects Stash instances, including publicly available instances that is, Internet-facing servers. XSS vulnerabilities allow an attacker to embed their own JavaScript into a Stash page. More information is...
Stash 1.0.3 Cross Site Scripting
Author: Author: Mr.SeCreT E-mail: [email protected] From: Syria http://english.islamweb.net/ Script Information: Script: Stash 1.0.3 Remote XSS Vulnerability Language: PHP Download: http://garr.dl.sourceforge.net/project/nice-stash/Stash%20CMS/1.0.3/stash-1.0.3.zip Vul Code: footer.inc.php: "My In...
Stash 1.0.3 Remote XSS Vulnerability
No description provided by source. Author: Author: Mr.SeCreT E-mail: [email protected]:[email protected] From: Syria http://english.islamweb.net/ Script Information: Script: Stash 1.0.3 Remote XSS Vulnerability Language: PHP Download:...
CVE-2008-4590
Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter to admin/login.php and 2 the post parameter to admin/news.php...
CVE-2008-4590
Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter to admin/login.php and 2 the post parameter to admin/news.php...
Sql injection
Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter to admin/login.php and 2 the post parameter to admin/news.php...
CVE-2008-4590
Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter to admin/login.php and 2 the post parameter to admin/news.php...
CVE-2008-4590
CVE-2008-4590 affects Stash 1.0.3 and involves multiple SQL injection vulnerabilities. The issues allow remote attackers to execute arbitrary SQL commands via (1) the username parameter to admin/login.php and (2) the post parameter to admin/news.php. The NVD notes a base score of 7.5 (HIGH) with ...
CVE-2008-4590: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Stash 1.0.3 allow remote attackers to execute arbitrary SQL commands via 1 the username parameter to admin/login.php and 2 the post parameter to admin/news.php...
Stash 1.0.3 (SQL) User Credentials Disclosure Exploit
No description provided by source. !/usr/bin/perl -w User credentials disclosure exploit - stash103exp.pl Gnix [email protected] http://gnix.netsons.org This exploit use an SQL Injection in the file admin/login.php to bypass the login, and then an SQL Injection in the admin/news.php to extract a...
CVE-2008-4080
SQL injection vulnerability in Stash 1.0.3, when magicquotesgpc is disabled, allows remote attackers to execute arbitrary SQL commands via the 1 username parameter to admin/library/authenticate.php and the 2 download parameter to downloadmp3.php. NOTE: some of these details are obtained from thir...