[SECURITY] [DSA 1568-1] New b2evolution packages fix cross site scripting

------------------------------------------------------------------------ Debian Security Advisory DSA-1568-1 [email protected] http://www.debian.org/security/ Thijs Kinkhorst May 05, 2008 http://www.debian.org/security/faq -...

DSA-1568-1 b2evolution - cross site scripting

Bulletin has no description...

CVE-2007-2681: Undefined Security Weakness

Directory traversal vulnerability in blogs/index.php in b2evolution 1.6 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the coresubdir parameter...

CVE-2007-2681

CVE-2007-2681 affects b2evolution 1.6: a directory traversal vulnerability in blogs/index.php accessible via the core_subdir parameter allows remote attackers to include and execute arbitrary local files using .. traversal. The connected documents confirm the same vulnerability details, but do no...

Remote file inclusion

Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the 1 incpath parameter to a anoskin.php, b astub.php, c admin.php, d contact.php, e default.php, f index.php, and g multiblogs.php in blogs/; the 2 viewpath and 3...

CVE-2007-2358

Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the 1 incpath parameter to a anoskin.php, b astub.php, c admin.php, d contact.php, e default.php, f index.php, and g multiblogs.php in blogs/; the 2 viewpath and 3...

CVE-2007-2358

Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the 1 incpath parameter to a anoskin.php, b astub.php, c admin.php, d contact.php, e default.php, f index.php, and g multiblogs.php in blogs/; the 2 viewpath and 3...

CVE-2007-2358

Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the 1 incpath parameter to a anoskin.php, b astub.php, c admin.php, d contact.php, e default.php, f index.php, and g multiblogs.php in blogs/; the 2 viewpath and 3...

CVE-2007-2358

CVE-2007-2358 affects b2evolution. It describes multiple PHP remote file inclusion vulnerabilities: arbitrary PHP code execution via URL parameters inc_path (to a_noskin.php, a_stub.php, admin.php, contact.php, default.php, index.php, multiblogs.php), view_path and control_path (to blogs/admin.ph...

CVE-2007-2358: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in b2evolution allow remote attackers to execute arbitrary PHP code via a URL in the 1 incpath parameter to a anoskin.php, b astub.php, c admin.php, d contact.php, e default.php, f index.php, and g multiblogs.php in blogs/; the 2 viewpath and 3...

Remote File Inclusion

b2evolution Remote File Inclusion Affected Software .: b2evolution Download..: http://b2evolution.net/ Risk ..............: high Date .........: 25/4/2007 Found by ..........: s433donlylinux Contact ...........: [email protected] Web .............: Www.hackerz.ir special thanx ........... A...

B2evolution 1.6 RFi

Script Name : B2evolution 1.6 Download : http://scripts.ringsworld.com/blog/b2evolution-1.6-2005-11-25.zip Coded by : KaRTaL Contact msn : k4rtalatgmaildotcom reguire : require dirnameFILE.'/'.$coresubdir.'blogmain.inc.php' ; exploit :...

JVN#64354801 b2evolution cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, session hijacking could be conducted. Solution Products Affected b2evolution Version 1.9.1 beta and earlier b2evolution Version 1.8.6 and earlier...

[SA23656] b2evolution "redirect_to" HTML Attribute Cross-Site Scripting

---------------------------------------------------------------------- Secunia is proud to announce the availability of the Secunia Software Inspector. The Secunia Software Inspector is a free service that detects insecure versions of software that you may have installed in your system. When...

CVE-2007-0175

Cross-site scripting XSS vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirectto parameter...

CVE-2007-0175

Cross-site scripting XSS vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirectto parameter...

CVE-2007-0175

CVE-2007-0175 describes an XSS vulnerability in b2evolution 1.8.6, where the htsrv/login.php script accepts scriptable attributes in the redirect_to parameter to inject arbitrary HTML/JS. Connected records corroborate remote cross-site scripting due to insufficient input sanitising. Debian/DSA-15...

CVE-2007-0175: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in htsrv/login.php in b2evolution 1.8.6 allows remote attackers to inject arbitrary web script or HTML via scriptable attributes in the redirectto parameter...

b2evolution远程文件包含漏洞

b2evolution是一款基于PHP的WEB应用程序。 b2evolution不正确过滤用户提交的URI数据，远程攻击者可以利用漏洞以WEB进程权限执行任意命令。 问题是由于'inc/CONTROL/imports/import-mt.php'脚本对用户提交的'incpath'参数缺少过滤，提交恶意的远程服务器作为包含对象，可导致以WEB进程权限执行任意PHP代码。 b2evolution 1.x 升级到最新版本： http://b2evolution.net/ http://victim/b2epath/inc/CONTROL/import/import-mt.php?basepat...

[SA23346] b2evolution "inc_path" File Inclusion Vulnerability

TITLE: b2evolution "incpath" File Inclusion Vulnerability SECUNIA ADVISORY ID: SA23346 VERIFY ADVISORY: http://secunia.com/advisories/23346/ CRITICAL: Highly critical IMPACT: System access WHERE: From remote SOFTWARE: b2evolution 1.x http://secunia.com/product/12768/ DESCRIPTION: tarkus has...