Fedora 15 : bugzilla-3.6.9-1.fc15 (2012-6396)

The following security issues have been discovered in Bugzilla : - When abusing the X-FORWARDED-FOR header, an attacker could bypass the lockout policy allowing a possible brute-force discovery of a valid user password. - An attacker can get access to some bug information using the victim's...

Fedora 16 : bugzilla-4.0.6-1.fc16 (2012-6368)

The following security issues have been discovered in Bugzilla : - When abusing the X-FORWARDED-FOR header, an attacker could bypass the lockout policy allowing a possible brute-force discovery of a valid user password. - An attacker can get access to some bug information using the victim's...

CVE-2012-0465

Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inboundproxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication...

CVE-2012-0465

Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inboundproxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication...

CVE-2012-0465

Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inboundproxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication...

CVE-2012-0465

CVE-2012-0465 affects Bugzilla versions 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1. Root cause: improper validation of the X-Forwarded-For header when inbound_proxies is enabled, allowing bypass of the lockout policy via repeated authentication re...

CVE-2012-0465: Undefined Security Weakness

Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inboundproxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication...

PT-2012-2586

Name of the Vulnerable Software and Affected Versions Bugzilla versions 3.5.x through 3.6.8 Bugzilla versions 3.7.x through 4.0.5 Bugzilla versions 4.1.x through 4.2.0 Description The issue allows remote attackers to bypass the lockout policy. This can be achieved via a series of authentication...

Security advisory for Bugzilla 4.2.1, 4.0.6 and 3.6.9

Summary ======= Bugzilla is a Web-based bug-tracking system used by a large number of software projects. The following security issues have been discovered in Bugzilla: When abusing the X-FORWARDED-FOR header, an attacker could bypass the lockout policy allowing a possible brute-force discovery o...

WS-2012-0007

Spoofing attack vulnerability via x-forwarded-for header in Premotion.AspNet.AppHarbor.Integration before 0.3.0...

Debian DSA-2332-1 : python-django - several issues

Paul McMillan, Mozilla and the Django core team discovered several vulnerabilities in Django, a Python web framework : - CVE-2011-4136 When using memory-based sessions and caching, Django sessions are stored directly in the root namespace of the cache. When user data is stored in the same cache, ...

DSA-2332-1 python-django - several issues

Bulletin has no description...

Sql injection

SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a send action...

CVE-2010-4897

CVE-2010-4897 is a SQL injection vulnerability affecting BlueCMS 1.6, specifically in comment.php. An attacker could send crafted requests via the X-Forwarded-For HTTP header in a send action to execute arbitrary SQL commands. This is supported by multiple sources (NVD, Red Hat, CVE records). The...

CVE-2010-4897: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a send action...

PT-2011-1832

Name of the Vulnerable Software and Affected Versions BlueCMS version 1.6 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the X-Forwarded-For HTTP header in a send action to the comment.php file. Recommendations For BlueCMS version 1.6, consid...

The Django development framework multiple security vulnerabilities-vulnerability warning-the black bar safety net

Affected version: Django 1.2.5 Django 1.3 beta 1 Django 1.2.4 Django 1.2.2 Django 1.2 Vulnerability description: Django is an open source Web application framework made of Python written. Django there are multiple security vulnerabilities, allow an attacker to obtain sensitive information,...

Django开发框架多个安全漏洞

Bugtraq ID: 49573 Django是一款开放源代码的Web应用框架，由Python写成。 Django存在多个安全漏洞，允许攻击者获得敏感信息，操作数据，进行缓存毒药攻击或进行拒绝服务攻击。 1当使用缓存后端时django.contrib.sessions中处理会话存在错误，可被利用操作会话信息。要成功个利用漏洞需要已知会话KEY和应用程序允许攻击者使用合法会话KEY储存字典类对象到缓冲中。 2Django模型系统包括一个字段类型-- URLField...

DEBIAN-CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...

CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...