111 matches found
Flyspray 0.9.9.6 - Cross-Site Request Forgery
Flyspray 0.9.9.6 - Cross-Site Request Forgery Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability Date: 06 Feb 2012 Author: Vaibhav Gupta Software Link: http://flyspray.org/flyspray-0.9.9.6.zip Version: 0.9.9.6 +---+CSRF Add Admin Account after authentication+---+ CSRF Exploit to add ADMIN account...
Flyspray 0.9.9.6 - Cross-Site Request Forgery
Exploit Title: Flyspray 0.9.9.6 CSRF Vulnerability Date: 06 Feb 2012 Author: Vaibhav Gupta Software Link: http://flyspray.org/flyspray-0.9.9.6.zip Version: 0.9.9.6 +---+CSRF Add Admin Account after authentication+---+ CSRF Exploit to add ADMIN account...
FreeBSD Ports: flyspray
The remote host is missing an update to the system as announced in the referenced advisory. VID 9d3020e4-a2c4-11dd-a9f9-0030843d3802 OpenVAS Vulnerability Test $ Description: Auto generated from VID 9d3020e4-a2c4-11dd-a9f9-0030843d3802 Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
FreeBSD Ports: flyspray
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
FreeBSD : flyspray -- multiple vulnerabilities (9d3020e4-a2c4-11dd-a9f9-0030843d3802)
The Flyspray Project reports : Flyspray is affected by a Cross Site scripting Vulnerability due to an error escaping PHP's $SERVER'QUERYSTRING' superglobal, that can be maliciously used to inject arbitrary code into the savesearch JavaScript function. There is an XSS problem in the history tab, t...
FreeBSD Ports: flyspray
The remote host is missing an update to the system as announced in the referenced advisory. VID f4b95430-51d8-11da-8e93-0010dc4afb40 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
FreeBSD Ports: flyspray
The remote host is missing an update to the system as announced in the referenced advisory. VID 209f0d75-4b5c-11dc-a6cd-000fb5066b20 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
FreeBSD Ports: flyspray
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
FreeBSD Ports: flyspray
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Flyspray 0.9.9 through 0.9.9.4 allow remote attackers to inject arbitrary web script or HTML via 1 a forced SQL error message or 2 oldvalue and newvalue database fields in task summaries, related to the itemsummary parameter in a details action...
CVE-2008-1166
Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames...
CVE-2008-1165
Multiple cross-site scripting XSS vulnerabilities in Flyspray 0.9.9 through 0.9.9.4 allow remote attackers to inject arbitrary web script or HTML via 1 a forced SQL error message or 2 oldvalue and newvalue database fields in task summaries, related to the itemsummary parameter in a details action...
Code injection
Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames...
CVE-2008-1165
Flyspray 0.9.9–0.9.9.4 is affected by multiple XSS vulnerabilities. The issues arise from improper sanitization in task summaries and related parameters: (1) forced SQL error messages, (2) old_value/new_value fields, and specifically the item_summary parameter in index.php?do=details. These flaws...
CVE-2008-1166
CVE-2008-1166 relates to Flyspray 0.9.9.4, where authentication errors reveal whether a username is valid or invalid. The description in the CVE entry and corroborating records state that this behavior enables remote attackers to enumerate usernames. The connected documents corroborate Flyspray a...
CVE-2008-1165
Multiple cross-site scripting XSS vulnerabilities in Flyspray 0.9.9 through 0.9.9.4 allow remote attackers to inject arbitrary web script or HTML via 1 a forced SQL error message or 2 oldvalue and newvalue database fields in task summaries, related to the itemsummary parameter in a details action...
CVE-2008-1166
Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames...
Flyspray 0.9.9 - Information DisclosureHTML Injection Cross-Site Scripting
Flyspray 0.9.9 - Information DisclosureHTML Injection Cross-Site Scripting source: https://www.securityfocus.com/bid/28076/info Flyspray is prone to an information-disclosure issue, an HTML-injection issue, and multiple cross-site scripting vulnerabilities because it fails to properly sanitize...
[DSECRG-08-017] Flyspray 0.9.9.4 Multiple Security Vulnerabilities
Digital Security Research Group DSecRG Advisory DSECRG-08-017 Application: Flyspray web-based bug tracking system Versions Affected: 0.9.9.4 Vendor URL: http://www.flyspray.org Bugs: SiXSS, Stored XSS, Brute Force Exploits: YES Reported: 08.02.2008 Vendor response: 08.02.2008 Solution: 24.02.2008...
Flyspray 0.9.9 - Information Disclosure/HTML Injection / Cross-Site Scripting
source: https://www.securityfocus.com/bid/28076/info Flyspray is prone to an information-disclosure issue, an HTML-injection issue, and multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues determine valid...