CVE-2007-3672

The CVE-2007-3672 entry concerns DotClear 1.2.6, specifically the ecrire/tools.php component. The vulnerability is a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML through unspecified form fields on the blogroll page. This is a client-side scri...

CVE-2007-3672

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

CVE-2007-3672: Undefined Security Weakness

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

[Full-disclosure] Dotclear 1.* Cross Site Scripting Vulnerability

Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing a remote attackers to hijack authenticated session Workaround: $postid trackback.php $toolurl/tools/thememng/index.php are not filtered 2-Proof of Concepts:...

CVE-2007-1989

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...

CVE-2007-1989

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...

CVE-2007-1989

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...

CVE-2007-1989

DotClear prior to 1.2.6 contains multiple XSS flaws that allow remote attackers to inject arbitrary script or HTML via (1) post_id in ecrire/trackback.php or (2) tool_url in tools/thememng/index.php. The NVD entry confirms these XSS vectors and notes details are sourced from third-party informati...

dotclear-xss.txt

------=Part236063482423.1176380209314 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Content-Disposition: inline Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing ...

CVE-2007-1989: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...

DotClear 1.2.x - ecriretrackback.php?post_id Cross-Site Scripting

DotClear 1.2.x - ecriretrackback.php?postid Cross-Site Scripting source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

DotClear 1.2.x - toolsthememngindex.php?tool_url Cross-Site Scripting

DotClear 1.2.x - toolsthememngindex.php?toolurl Cross-Site Scripting source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

DotClear 1.2.x - '/ecrire/trackback.php?post_id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

DotClear 1.2.x - '/tools/thememng/index.php?tool_url' Cross-Site Scripting

source: https://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

DotClear v1.2.5

DotClear v1.2.5 = RFi Vulnerabilities KaRTaL Download : http://www.spacemarc.it/scriptphp/index.php?script=meganoidesnews111 Script Name : DotClear v1.2.5 Coded By : KaRTaL Contact : k4rtalatgmaildotcom V.Code in : path/index.php require $blogdcpath.'/layout/append.php'; Exploit :...

DotClear Full Path Disclosure Vulnerability

I have contacted the developers 2 weeks ago, still no answer... Vendor: DotClear Vulnerable: DotClear 1.2.5 and below Release Date: 2007-01-28 Full Path Disclosure This vulnerability affects: http://www.example.com/dotclear/themes/default/form.php...

CVE-2006-3938

DotClear allows remote attackers to obtain sensitive information via a direct request for 1 editcat.php, 2 index.php, 3 editlink.php in ecrire/tools/blogroll/; 4 syslog/index.php, 5 thememng/index.php, 6 toolsmng/index.php, 7 utf8convert/index.php in /ecrire/tools/; 8 /ecrire/inc/connexion.php an...

CVE-2006-3938

CVE-2006-3938 affects DotClear. The vulnerability allows remote attackers to obtain sensitive information by directly requesting multiple files (e.g., edit_cat.php, syslog/index.php, class.blog.php, template.php) under /ecrire/tools/, /inc/, /layout/, and /themes/default/. The root cause is that ...

CVE-2006-3938

DotClear allows remote attackers to obtain sensitive information via a direct request for 1 editcat.php, 2 index.php, 3 editlink.php in ecrire/tools/blogroll/; 4 syslog/index.php, 5 thememng/index.php, 6 toolsmng/index.php, 7 utf8convert/index.php in /ecrire/tools/; 8 /ecrire/inc/connexion.php an...