CVE-2008-3887

CVE-2008-3887 affects dotProject 2.1.2, specifically SQL injection in index.php. The vulnerabilities allow remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and remote authenticated administrators to do so via the user_id parameter in a viewu...

CVE-2008-3887

Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow 1 remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and 2 remote authenticated administrators to execute arbitrary SQL commands via the userid parameter in a viewus...

CVE-2008-3886

Multiple cross-site scripting XSS vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the inactive parameter in a tasks action, 2 the date parameter in a calendar dayview action, 3 the callback parameter in a public calendar action,...

CVE-2008-3886: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in index.php in dotProject 2.1.2 allow remote attackers to inject arbitrary web script or HTML via 1 the inactive parameter in a tasks action, 2 the date parameter in a calendar dayview action, 3 the callback parameter in a public calendar action,...

CVE-2008-3887: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in index.php in dotProject 2.1.2 allow 1 remote authenticated users to execute arbitrary SQL commands via the tab parameter in a projects action, and 2 remote authenticated administrators to execute arbitrary SQL commands via the userid parameter in a viewus...

dotProject Multiple XSS and SQLi Vulnerabilities

dotProject is prone to multiple cross-site scripting CSS and SQL injection SQLi vulnerabilities. SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-onl...

dotproject-sqlxss.txt

======================================================================= . .. | | / / | | | | / \ / / /\ / / \ | | | / / \ /\ \| | / // / /\ \ / / / // http://wwwlowsec.org ======================================================================== Author: C1c4Tr1Z Date: 28/08/08...

dotProject 2.1.2 - Multiple SQL Injections Cross-Site Scripting Vulnerabilities

dotProject 2.1.2 - Multiple SQL Injections Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30924/info dotProject is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may...

dotProject 2.1.2 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/30924/info dotProject is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the...

dotProject cross-site scripting vulnerability

Overview dotProject, an open source project management tool, contains a cross-site scripting vulnerability. This vulnerability is different from JVN97636431. Impact An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, sessio...

dotProject cross-site scripting vulnerability

Overview dotProject, an open source project management tool, contains a cross-site scripting vulnerability. As of June 5, 2006, it is confirmed that Internet Explorer is affected by this vulnerability. It is also confirmed that Mozilla Firefox and Opera are not affected by this vulnerability...

dotProject cross-site scripting vulnerability

Overview dotProject, an open source project management tool, contains a cross-site scripting vulnerability. This vulnerability is different from JVN97636431. Impact An arbitrary script may be executed on the user's web browser. In particular, if session information from a cookie is leaked, an...

Information disclosure

dotProject before 2.1 does not properly check privileges when invoking the Companies module, which allows remote attackers to access this module via a crafted URL. NOTE: some of these details are obtained from third party information...

CVE-2007-5486

dotProject before 2.1 does not properly check privileges when invoking the Companies module, which allows remote attackers to access this module via a crafted URL. NOTE: some of these details are obtained from third party information...

CVE-2007-5486

CVE-2007-5486 affects dotProject before version 2.1, where the Companies module does not properly enforce privileges. This allows remote attackers to access the Companies module via a crafted URL. The issue is a privilege-check vulnerability leading to unauthorized access (partial confidentiality...

CVE-2007-5486

dotProject before 2.1 does not properly check privileges when invoking the Companies module, which allows remote attackers to access this module via a crafted URL. NOTE: some of these details are obtained from third party information...

CVE-2007-5486: Undefined Security Weakness

dotProject before 2.1 does not properly check privileges when invoking the Companies module, which allows remote attackers to access this module via a crafted URL. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in dotProject before 2.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2006-2851 and CVE-2006-3240...

CVE-2007-3226

Cross-site scripting XSS vulnerability in dotProject before 2.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2006-2851 and CVE-2006-3240...

CVE-2007-3226

Cross-site scripting XSS vulnerability in dotProject before 2.1 RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2006-2851 and CVE-2006-3240...