flyspray -- multiple vulnerabilities

The Flyspray Project reports: Flyspray is affected by a Cross Site scripting Vulnerability due to an error escaping PHP's $SERVER'QUERYSTRING' superglobal, that can be maliciously used to inject arbitrary code into the savesearch javascript function. There is an XSS problem in the history tab, th...

Debian Security Advisory DSA 953-1 (flyspray)

The remote host is missing an update to flyspray announced via advisory DSA 953-1. Several cross-site scripting vulnerabilities have been discovered in flyspray, a lightweight bug tracking system, which allows attackers to insert arbitrary script code into the index page. The old stable...

Debian: Security Advisory (DSA-953-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2007-6461

Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...

CVE-2007-6461

Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...

CVE-2007-6461

Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...

CVE-2007-6461

CVE-2007-6461 affects Flyspray 0.9.9–0.9.9.3, with cross-site scripting vulnerabilities in index.php. An attacker can inject arbitrary web script or HTML via (1) the query string in an index action (related to savesearch JavaScript) and (2) the details parameter in a details action (related to th...

CVE-2007-6461

Multiple cross-site scripting XSS vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via 1 the query string in an index action, related to the savesearch JavaScript function; and 2 the details parameter in a details action,...

Flyspray 0.9.9 - Multiple Cross-Site Scripting Vulnerabilities

Flyspray 0.9.9 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/26891/info Flyspray is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

Flyspray 0.9.9 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/26891/info Flyspray is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

FreeBSD : flyspray -- authentication bypass (209f0d75-4b5c-11dc-a6cd-000fb5066b20)

The Flyspray Project reports : Flyspray authentication system can be bypassed by sending a carefully crafted post request. To be vulnerable, PHP configuration directive outputbuffering has to be disabled or set to a low value. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive...

Authentication flaw

Flyspray 0.9.9, when outputbuffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request...

CVE-2007-1789

Flyspray 0.9.9 allows remote attackers to obtain sensitive information private project summaries via direct requests...

CVE-2007-1789

Flyspray 0.9.9 allows remote attackers to obtain sensitive information private project summaries via direct requests...

CVE-2007-1788

Flyspray 0.9.9, when outputbuffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request...

CVE-2007-1788

Flyspray 0.9.9, when outputbuffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request...

Information disclosure

Flyspray 0.9.9 allows remote attackers to obtain sensitive information private project summaries via direct requests...

CVE-2007-1788

The CVE-2007-1788 entry concerns Flyspray 0.9.9 where authentication can be bypassed by a crafted POST request if PHP output_buffering is disabled or set to a low value. Multiple connected sources corroborate this, describing an authentication bypass tied to the output_buffering setting and a cra...

CVE-2007-1788

Flyspray 0.9.9, when outputbuffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request...

CVE-2007-1789

Flyspray 0.9.9 allows remote attackers to obtain sensitive information private project summaries via direct requests...