EUVD-2007-3672

Malware in sbrugna...

EUVD-2007-3656

Malware in sbrugna...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the 1 toolurl parameter to ecrire/tools.php and multiple fields on the 2 blogconf, 3 blogroll, 4 ecrire/redacteur.php, and 5 ecrire/userprefs.php pages...

CVE-2007-3688

Multiple cross-site request forgery CSRF vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the 1 toolurl parameter to ecrire/tools.php and multiple fields on the 2 blogconf, 3 blogroll, 4 ecrire/redacteur.php, and 5 ecrire/userprefs.php pages...

CVE-2007-3688

The vulnerability described across sources concerns DotClear 1.2.6, where multiple cross-site request forgery (CSRF) flaws allow remote attackers to perform actions as arbitrary users. The entry specifies exploitation via the tool_url parameter to ecrire/tools.php and through several fields on pa...

CVE-2007-3672

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

CVE-2007-3672

The CVE-2007-3672 entry concerns DotClear 1.2.6, specifically the ecrire/tools.php component. The vulnerability is a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML through unspecified form fields on the blogroll page. This is a client-side scri...

[Full-disclosure] Dotclear 1.* Cross Site Scripting Vulnerability

Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing a remote attackers to hijack authenticated session Workaround: $postid trackback.php $toolurl/tools/thememng/index.php are not filtered 2-Proof of Concepts:...

dotclear-xss.txt

------=Part236063482423.1176380209314 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing ...