USN-592-1: Firefox vulnerabilities

Alexey Proskuryakov, Yosuke Hasegawa and Simon Montagu discovered flaws in Firefox's character encoding handling. If a user were tricked into opening a malicious web page, an attacker could perform cross-site scripting attacks. CVE-2008-0416 Various flaws were discovered in the JavaScript engine...

Mozilla Foundation Security Advisory 2008-17

Mozilla Foundation Security Advisory 2008-17 Title: Privacy issue with SSL Client Authentication Impact: Low Announced: March 25, 2008 Reporter: Peter Brodersen and Alexander Klink Products: Firefox, SeaMonkey Fixed in: Firefox 2.0.0.13 SeaMonkey 1.1.9 Description Peter Brodersen and Alexander...

[SECURITY] Fedora 8 Update: roundup-1.4.4-1.fc8

Roundup is a simple and flexible issue-tracking system with command line, web and email interfaces. It is based on the winning design from Ka-Ping Yee in the Software Carpentry "Track" design competition...

[SECURITY] Fedora 7 Update: roundup-1.4.4-1.fc7

Roundup is a simple and flexible issue-tracking system with command line, web and email interfaces. It is based on the winning design from Ka-Ping Yee in the Software Carpentry "Track" design competition...

Mantis: Cross-Site Scripting

Background Mantis is a web-based bug tracking system. Description seiji reported that the filename for the uploaded file in bugreport.php is not properly sanitised before being stored. Impact A remote attacker could upload a file with a specially crafted to a bug report, resulting in the executio...

CVE-2008-0814: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in download.php in Tracking Requirements & Use Cases TRUC 0.11.0 allows remote attackers to read arbitrary files via a .. dot dot in the uploadfilename parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal allows remote...

CVE-2008-0577

The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal 1 does not restrict the extensions of attached files when the...

CVE-2008-0576

Cross-site scripting XSS vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal allows remote...

CVE-2008-0576

Cross-site scripting XSS vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal allows remote...

CVE-2008-0577

The CVE-2008-0577 entry concerns Drupal’s Project Issue Tracking module (5.x-2.x-dev prior to 20080130; 5.x-1.x prior to 1.2; 4.7.x prior to 2.6/1.6). The description states two vulnerabilities when the Upload module is enabled for issue nodes: (1) it does not restrict extensions of attached file...

CVE-2008-0577

The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal 1 does not restrict the extensions of attached files when the...

CVE-2008-0576: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal allows remote...

CVE-2008-0577: Undefined Security Weakness

The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier in the 4.7.x-2.x series, and 4.7.x-1.6 and earlier in the 4.7.x-1.x series for Drupal 1 does not restrict the extensions of attached files when the...

SA-2008-013 - Project issue tracking - Arbitrary file upload

The Project issue tracking module has a vulnerability where new issues are not properly validated. If the core Upload module is enabled on issue nodes the recommended configuration for the 5.x-2. series, this vulnerability can be used to attach malicious files to new issues, regardless of the...

SA-2008-012 - Project issue tracking - XSS vulnerability in comment summary tables

The Project issue tracking module provides a summary table to show changes in issue states between comments. Users who have certain editing rights may be able to inject arbitrary code on pages containing these tables. Wikipedia has more information about cross site scripting XSS. Versions affecte...

DSA-1467-1 mantis - several vulnerabilities

Bulletin has no description...

Debian Security Advisory DSA 1133-1 (mantis)

The remote host is missing an update to mantis announced via advisory DSA 1133-1. Several remote vulnerabilities have been discovered in the Mantis bug tracking system, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the followi...

Debian Security Advisory DSA 944-1 (mantis)

The remote host is missing an update to mantis announced via advisory DSA 944-1. Several security related problems have been discovered in Mantis, a web-based bug tracking system. For details on the issues resolved, please visit the referenced advisories. The old stable distribution woody does no...

Debian Security Advisory DSA 173-1 (bugzilla)

The remote host is missing an update to bugzilla announced via advisory DSA 173-1. OpenVAS Vulnerability Test $Id: deb1731.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 173-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...