[SECURITY] [DSA 1818-1] New gforge packages fix insufficient input sanitising

------------------------------------------------------------------------ Debian Security Advisory DSA-1818-1 [email protected] http://www.debian.org/security/ Steffen Joeris June 18, 2009 http://www.debian.org/security/faq -...

Debian DSA-1818-1 : gforge - insufficient input sanitising

Laurent Almeras and Guillaume Smet have discovered a possible SQL injection vulnerability and cross-site scripting vulnerabilities in gforge, a collaborative development tool. Due to insufficient input sanitising, it was possible to inject arbitrary SQL statements and use several parameters to...

[SECURITY] [DSA 1818-1] New gforge packages fix insufficient input sanitising

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------ Debian Security Advisory DSA-1818-1 [email protected] http://www.debian.org/security/ Steffen Joeris June 18, 2009 http://www.debian.org/security/faq -...

DSA-1818-1 gforge - insufficient input sanitising

Bulletin has no description...

GForge Multiple SQL Injection Vulnerabilities

GForge is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the...

GForge Multiple SQLi Vulnerabilities (Mar 2009) - Active Check

GForge is prone to multiple SQL injection SQLi vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

GForge多个SQL注入漏洞

BUGTRAQ ID: 31674 CVECAN ID: CVE-2008-6187,CVE-2008-6188,CVE-2008-6189 GForge是用于管理软件开发周期的工具。 GForge的new/index.php、news/index.php和top/topusers.php文件没有正确地过滤offset输入参数： function dbquery$qstring,$limit='-1',$offset=0 global $QUERYCOUNT; $QUERYCOUNT++; if $limit 0 if !$offset || $offset 0 $offset=0;...

CVE-2008-6189

SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to 1 new/index.php, 2 news/index.php, and 3 top/topusers.php, which is not properly handled in database-pgsql.php...

Sql injection

SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitrary SQL commands via the releaseid parameter...

Sql injection

SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skilledit parameter...

Sql injection

SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to 1 new/index.php, 2 news/index.php, and 3 top/topusers.php, which is not properly handled in database-pgsql.php...

CVE-2008-6188

SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skilledit parameter...

CVE-2008-6187

SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitrary SQL commands via the releaseid parameter...

CVE-2008-6189

SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to 1 new/index.php, 2 news/index.php, and 3 top/topusers.php, which is not properly handled in database-pgsql.php...

CVE-2008-6187

SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitrary SQL commands via the releaseid parameter...

CVE-2008-6188

SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skilledit parameter...

CVE-2008-6189

Summary: CVE-2008-6189 affects the GForge web application. Affected versions include GForge 4.5.19 (and 4.6 b1 per OpenVAS) where the offset parameter in certain pages is not properly filtered before use in SQL queries, traced to the vulnerable code path in database-pgsql.php. The vulnerable endp...

CVE-2008-6188

CVE-2008-6188 affects GForge 4.6 rc1 and earlier. The SQL injection exists in people/editprofile.php via the skill_edit[] parameter, enabling remote attackers to inject arbitrary SQL. Connected sources confirm the affected software and input vector; no vendor patch is provided in the documents, s...

CVE-2008-6187

CVE-2008-6187 affects GForge 4.5.19 and earlier. The vulnerability is a SQL injection in frs/shownotes.php via the release_id parameter, allowing remote attackers to execute arbitrary SQL commands. The NVD entry lists a CVSS v2 base score of 7.5 (HIGH) with network attack vector and no authentica...

CVE-2008-6189

SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to 1 new/index.php, 2 news/index.php, and 3 top/topusers.php, which is not properly handled in database-pgsql.php...