Cross site scripting

Cross-site scripting XSS vulnerability in index.php in dotProject 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, which are not properly handled when the client is using Internet Explorer...

CVE-2006-2851

Cross-site scripting XSS vulnerability in index.php in dotProject 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, which are not properly handled when the client is using Internet Explorer...

CVE-2006-2851

Cross-site scripting XSS vulnerability in index.php in dotProject 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, which are not properly handled when the client is using Internet Explorer...

CVE-2006-2851

dotProject 2.0.2 and earlier contains a Cross-site Scripting (XSS) vulnerability in index.php, exploitable via unspecified parameters, with IE affected and potential for executing arbitrary script or HTML in the victim’s browser. The issue stems from parameters not being properly handled client-s...

CVE-2006-2851: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in dotProject 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, which are not properly handled when the client is using Internet Explorer...

JVN#97636431 dotProject cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. If session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected dotProject 2.0.2 and earlier As of June 5, 2006, it is confirmed that Internet Explorer is affecte...

[SA20418] dotProject Cross-Site Scripting Vulnerability

---------------------------------------------------------------------- Want to join the Secunia Security Team? Secunia offers a position as a security specialist, where your daily work involves reverse engineering of software and exploit code, auditing of source code, and analysis of vulnerabilit...

CVE-2006-0754

dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the...

Design/Logic Flaw

DISPUTED Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in 1 dbadodb.php, 2 dbconnect.php, 3 session.php, 4 vwusrroles.php, 5 calendar.php, 6...

CVE-2006-0755

Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in 1 dbadodb.php, 2 dbconnect.php, 3 session.php, 4 vwusrroles.php, 5 calendar.php, 6 dateformat.php, a...

CVE-2006-0756

dotProject 2.0.1 and earlier leaves 1 phpinfo.php and 2 check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignor...

CVE-2006-0755

DotProject, versions ≤2.0.1, contains multiple PHP remote file inclusion vulnerabilities exploitable when register_globals is enabled. The baseDir parameter in (1) db_adodb.php, (2) db_connect.php, (3) session.php, (4) vw_usr_roles.php, (5) calendar.php, (6) date_format.php, (7) tasks/gantt.php a...

CVE-2006-0755

Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in 1 dbadodb.php, 2 dbconnect.php, 3 session.php, 4 vwusrroles.php, 5 calendar.php, 6 dateformat.php, a...

CVE-2006-0754

CVE-2006-0754 affects dotProject 2.0.1 and earlier. The issue allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, revealing the path in an error message. Related connected sources also describe multiple sc...

CVE-2006-0754

dotProject 2.0.1 and earlier allows remote attackers to obtain sensitive information via direct requests with an invalid baseDir to certain PHP scripts in the db directory, which reveal the path in an error message. NOTE: the vendor disputes this issue, saying that it could only occur if the...

CVE-2006-0755

Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in 1 dbadodb.php, 2 dbconnect.php, 3 session.php, 4 vwusrroles.php, 5 calendar.php, 6 dateformat.php, a...

CVE-2006-0756

dotProject 2.0.1 and earlier leaves 1 phpinfo.php and 2 check.php accessible under the /docs/ directory after installation, which allows remote attackers to obtain sensitive configuration information. NOTE: the vendor disputes this issue, saying that it could only occur if the administrator ignor...

CVE-2006-0756

CVE-2006-0756 affects dotProject versions 2.0.1 and earlier. The issue: phpinfo.php and check.php remain accessible under the /docs/ directory after installation, allowing remote attackers to obtain sensitive configuration information. The vendor disputes the flaw, noting it occurs only if instal...

CVE-2006-0755: Undefined Security Weakness

Multiple PHP remote file include vulnerabilities in dotProject 2.0.1 and earlier, when registerglobals is enabled, allow remote attackers to execute arbitrary commands via the baseDir parameter in 1 dbadodb.php, 2 dbconnect.php, 3 session.php, 4 vwusrroles.php, 5 calendar.php, 6 dateformat.php, a...

PT-2006-1804 · Dotproject · Dotproject

Name of the Vulnerable Software and Affected Versions: dotProject versions 2.0.1 and earlier Description: The issue allows remote attackers to execute arbitrary commands via the baseDir parameter in several PHP files, including db adodb.php, db connect.php, session.php, vw usr roles.php,...