CVE-2007-1789

Flyspray 0.9.9 allows remote attackers to obtain sensitive information private project summaries via direct requests...

flyspray -- authentication bypass

The Flyspray Project reports: Flyspray authentication system can be bypassed by sending a carefully crafted post request. To be vulnerable, PHP configuration directive outputbuffering has to be disabled or set to a low value...

CVE-2006-6203

Directory traversal vulnerability in startdown.php in the Flyspray ME 1.0.1 comflyspray component for Mambo allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2006-6203

Directory traversal vulnerability in startdown.php in the Flyspray ME 1.0.1 comflyspray component for Mambo allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

CVE-2006-6203

The CVE-2006-6203 issue is a directory traversal vulnerability in Flyspray ME 1.0.1 (com_flyspray) used with Mambo. An attacker can exploit a dot-dot (..) in the file parameter of startdown.php to read arbitrary files on the server. Affected software: Flyspray ME 1.0.1 (com_flyspray) component fo...

Debian DSA-953-1 : flyspray - missing input sanitising

Several cross-site scripting vulnerabilities have been discovered in flyspray, a lightweight bug tracking system, which allows attackers to insert arbitrary script code into the index page. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

FreeBSD : flyspray -- XSS vulnerabilities (f4b95430-51d8-11da-8e93-0010dc4afb40)

A Secunia Advisory reports : Lostmon has reported some vulnerabilities in Flyspray, which can be exploited by malicious people to conduct cross-site scripting attacks. Some input isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script...

Flyspray install-0.9.7.php adodbpath Parameter Remote File Inclusion

The remote host is running Flyspray, an open source, web-based, bug tracking system written in PHP. The installed version of Flyspray contains an installation script that does not require authentication and that fails to sanitize user input to the 'adodbpath' parameter before using it in a PHP...

Directory traversal

Directory traversal vulnerability in the installation file sql/install-0.9.7.php in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. dot dot sequence in the adodbpath parameter...

CVE-2006-0714

Directory traversal vulnerability in the installation file sql/install-0.9.7.php in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. dot dot sequence in the adodbpath parameter...

CVE-2006-0714

Directory traversal vulnerability in the installation file sql/install-0.9.7.php in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. dot dot sequence in the adodbpath parameter...

CVE-2006-0714

Directory traversal vulnerability in the installation file sql/install-0.9.7.php in Flyspray 0.9.7 allows remote attackers to include arbitrary files via a .. dot dot sequence in the adodbpath parameter...

CVE-2006-0714

Flyspray 0.9.7 is vulnerable to a directory traversal/remote file inclusion in the installation script sql/install-0.9.7.php via the adodbpath parameter. The adodbpath input is unsafely used in include_once(), allowing an unauthenticated attacker to view arbitrary files and potentially execute PH...

egs_10rc4_php5_incl_xpl.php.txt

--------EGS Enterprise Groupware System 1.0 rc4 possibly prior versions------- remote code execution -------------------------------------------------------------------------------- software: site: http://egs.sourceforge.net/ description: "EGS is an Open Source business system released under the...

EGS Enterprise Groupware System 1.0 rc4 remote commands execution & FlySpray 0.9.7 remote commands execution

--------EGS Enterprise Groupware System 1.0 rc4 possibly prior versions------- remote code execution -------------------------------------------------------------------------------- software: site: http://egs.sourceforge.net/ description: "EGS is an Open Source business system released under the...

FlySpray 0.9.7 - 'install-0.9.7.php' Remote Command Execution

works against PHP5 usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "Therefore the good fighter will be terrible in his onset, and prompt in his decision" / short explaination: found this bug in FlySpray, exploiting EGS Enterprise Groupware System 1.0 rc4, see this link for...

FlySpray 0.9.7 - install-0.9.7.php Remote Command Execution

FlySpray 0.9.7 - install-0.9.7.php Remote Command Execution works against PHP5 usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "Therefore the good fighter will be terrible in his onset, and prompt in his decision" / short explaination: found this bug in FlySpray, exploiting...

FlySpray 0.9.7 (install-0.9.7.php) Remote Commands Execution Exploit

No description provided by source. ?php ---flyspray097php5inclxpl.php 19.57 13/02/2006 FlySpray 0.9.7 remote commands execution exploit coded by rgod site: http://retrogod.altervista.org - works against PHP5 usage: launch from Apache, fill in requested fields, then go! Sun-Tzu: "Therefore the goo...

FlySpray 0.9.7 (install-0.9.7.php) Remote Commands Execution Exploit

Exploit for unknown platform in category web applications ==================================================================== FlySpray 0.9.7 install-0.9.7.php Remote Commands Execution Exploit ==================================================================== works against PHP5 usage: launch...

[SECURITY] [DSA 953-1] New flyspray packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 953-1 [email protected] http://www.debian.org/security/ Martin Schulze January 24th, 2006 http://www.debian.org/security/faq -...