Luxbum 0.5.5 SQL Injection

/\ \ \ \ /'\ \ \ , auth bypass URL: http://www.luxbum.net/ Found by: knxone Greetings: Pirata from this famous irc server ; +=========+ | CONCEPT | +=========+ Luxbum allows authentification using dotclear username and password via MySQL, while the default auth mechanism uses a md5 hash of the...

CVE-2009-0933

Cross-site scripting XSS vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-0933

CVE-2009-0933 is an XSS vulnerability affecting the Dotclear administrative interface prior to version 2.1.5. The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The provided documents identify the affected product and version but do not speci...

CVE-2009-0933

Cross-site scripting XSS vulnerability in the administrative interface in Dotclear before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2008-3232

Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images...

Unrestricted file upload

Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images...

CVE-2008-3232

Unrestricted file upload vulnerability in ecrire/images.php in Dotclear 1.2.7.1 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images...

CVE-2008-3232

Dotclear 1.2.7.1 and earlier are affected by an unrestricted file upload vulnerability in ecrire/images.php. Remote authenticated users can upload a file with an executable extension and access it directly in images, enabling arbitrary code execution. Affected versions: Dotclear 1.2.7.1 and earli...

Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability

Advisory 1 "Dotclear 'ecrire/images.php' Arbitrary File Upload Vulnerability" $ Author : Morgan ARMAND $ Contact : armandm at epitech dot net $ Vendor URL : http://www.dotclear.net $ Vendor Contacted : 07/04/2008 $ Vendor Status : No response $ Affected Software : Dotclear = 1.2.7.1 $ Severity :...

Dotclear remote script execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, There is a French website about two vulnerabilities ; the one works on Wordpress 27/05/2007 and the other on Dotclear 08/07/2007 : http://ar3av.free.fr/sommaire.php If a Dotclear blog administrator is logged in or has a cookie for automatic...

CVE-2007-3688

Multiple cross-site request forgery CSRF vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the 1 toolurl parameter to ecrire/tools.php and multiple fields on the 2 blogconf, 3 blogroll, 4 ecrire/redacteur.php, and 5 ecrire/userprefs.php pages...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the 1 toolurl parameter to ecrire/tools.php and multiple fields on the 2 blogconf, 3 blogroll, 4 ecrire/redacteur.php, and 5 ecrire/userprefs.php pages...

CVE-2007-3688

Multiple cross-site request forgery CSRF vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the 1 toolurl parameter to ecrire/tools.php and multiple fields on the 2 blogconf, 3 blogroll, 4 ecrire/redacteur.php, and 5 ecrire/userprefs.php pages...

CVE-2007-3688

The vulnerability described across sources concerns DotClear 1.2.6, where multiple cross-site request forgery (CSRF) flaws allow remote attackers to perform actions as arbitrary users. The entry specifies exploitation via the tool_url parameter to ecrire/tools.php and through several fields on pa...

Cross site scripting

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

CVE-2007-3672

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

CVE-2007-3672

Cross-site scripting XSS vulnerability in ecrire/tools.php in DotClear 1.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified form fields on the blogroll page...

CVE-2007-3672

The CVE-2007-3672 entry concerns DotClear 1.2.6, specifically the ecrire/tools.php component. The vulnerability is a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML through unspecified form fields on the blogroll page. This is a client-side scri...

[Full-disclosure] Dotclear 1.* Cross Site Scripting Vulnerability

Dotclear 1. Cross Site Scripting Vulnerability 1--two cross site scripting vulnerabilities have been discovered in the dotclear1. allowing a remote attackers to hijack authenticated session Workaround: $postid trackback.php $toolurl/tools/thememng/index.php are not filtered 2-Proof of Concepts:...