[SECURITY] [DSA 1369-1] New gforge packages fix SQL injection

-------------------------------------------------------------------------- Debian Security Advisory DSA 1369-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff September 6th, 2007 http://www.debian.org/security/faq -...

DSA-1369-1 gforge - SQL injection

Bulletin has no description...

CVE-2007-0246

plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATHINFO...

Code injection

plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATHINFO...

CVE-2007-0246

plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATHINFO...

CVE-2007-0246

plugins/scmcvs/www/cvsweb.php in the CVSWeb CGI in GForge 4.5.16 before 20070524, aka gforge-plugin-scmcvs, allows remote attackers to execute arbitrary commands via shell metacharacters in the PATHINFO...

CVE-2007-0246

CVE-2007-0246 affects GForge’s CVSWeb CGI (plugins/scmcvs/www/cvsweb.php) running with CVSWeb in GForge 4.5.16 prior to 20070524. The vulnerability arises from insufficient sanitization of PATH_INFO, allowing remote attackers to inject shell metacharacters and execute arbitrary commands. Reported...

GForge CVSWeb CGI cvsweb.php PATH_INFO Parameter Arbitrary Command Execution

The remote host is running GForge, a web-based project for collaborative software development. The version of GForge installed on the remote host fails to sanitize user-supplied input to the 'plugins/scmcvs/cvsweb.php' script before using it to execute a shell command. An unauthenticated attacker...

Debian DSA-1297-1 : gforge-plugin-scmcvs - missing input sanitising

Bernhard R. Link discovered that the CVS browsing interface of Gforge, a collaborative development tool, performs insufficient escaping of URLs, which allows the execution of arbitrary shell commands with the privileges of the www-data user. The oldstable distribution sarge is not affected by thi...

[SECURITY] [DSA 1297-1] New gforge-plugin-scmcvs packages fix arbitrary shell command execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 1297-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 24th, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1297-1] New gforge-plugin-scmcvs packages fix arbitrary shell command execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 1297-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff May 24th, 2007 http://www.debian.org/security/faq -...

DSA-1297-1 gforge-plugin-scmcvs

Bulletin has no description...

CVE-2007-0176

Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...

CVE-2007-0176

Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...

CVE-2007-0176

Cross-site scripting XSS vulnerability in search/advancedsearch.php in GForge 4.5.11 allows remote attackers to inject arbitrary web script or HTML via the words parameter...

CVE-2007-0176

GForge contains a cross-site scripting (XSS) vulnerability in search/advanced_search.php (words parameter) affecting version 4.5.11 (and related builds). The flaw allows remote injection of arbitrary scripts/HTML in the context of a logged-in user. Debian DSAs note a fix in 4.5.14 (and related up...

GForge Cross Site Scripting vulnerability

GForge Cross Site Scripting vulnerability Version: Tested on GForge 4.5.11 Discovered by: Jose Ramon Palanco: jose.palancoateazeldotes http://www.eazel.es Description: GForge is vulnerable to a security vulnerability that allow Cross-Site Scripting attacks. Due to improper filtering, a remote...

Debian DSA-1094-1 : gforge - missing input sanitising

Joxean Koret discovered several cross-site scripting vulnerabilities in Gforge, an online collaboration suite for software development, which allow injection of web script code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 1094-1] New gforge packages fix cross-site scripting

-------------------------------------------------------------------------- Debian Security Advisory DSA 1094-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff June 8th, 2006 http://www.debian.org/security/faq -...