DSA-1094-1 gforge - missing input sanitising

Bulletin has no description...

CVE-2005-1752

viewFile.php in the scm component of Gforge before 4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename parameter...

CVE-2005-1752

CVE-2005-1752 affects the Gforge SCM component, specifically viewFile.php, where the file_name parameter can be manipulated to execute arbitrary shell commands. The issue exists in Gforge before version 4.0, enabling remote attackers to run commands with the shell via crafted input. The provided ...

CVE-2005-1752

viewFile.php in the scm component of Gforge before 4.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename parameter...

gforgeexec.txt

-------------------------------------------------------------------------- Vendor : Gforge http://gforge.org Product : gforge Affected versions : = 4.0 & Debian pkg 3.1-30 Vulnerability : Input validation flaw Problem-Type : remote Severity : High, arbitrary command execution Author : Filippo Spi...

gforgeXSS.txt

--------------------------------------------------------------------------- Various Vulnerabilities in GForge --------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2005 Location: Basque Country...

CVE-2005-2430

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 forumid or 2 groupid parameter to forum.php, 3 projecttaskid parameter to task.php, 4 id parameter to detail.php, 5 the text field on the search page, 6 groupid...

CVE-2005-2431

The 1 lost password and 2 account pending features in GForge 4.5 do not properly set a limit on the number of e-mails sent to an e-mail address, which allows remote attackers to send a large number of messages to arbitrary e-mail addresses aka mail bomb...

CVE-2005-2431

The 1 lost password and 2 account pending features in GForge 4.5 do not properly set a limit on the number of e-mails sent to an e-mail address, which allows remote attackers to send a large number of messages to arbitrary e-mail addresses aka mail bomb...

CVE-2005-2431

The 1 lost password and 2 account pending features in GForge 4.5 do not properly set a limit on the number of e-mails sent to an e-mail address, which allows remote attackers to send a large number of messages to arbitrary e-mail addresses aka mail bomb...

CVE-2005-2430

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 forumid or 2 groupid parameter to forum.php, 3 projecttaskid parameter to task.php, 4 id parameter to detail.php, 5 the text field on the search page, 6 groupid...

CVE-2005-2430

Multiple cross-site scripting XSS vulnerabilities in GForge 4.5 allow remote attackers to inject arbitrary web script or HTML via the 1 forumid or 2 groupid parameter to forum.php, 3 projecttaskid parameter to task.php, 4 id parameter to detail.php, 5 the text field on the search page, 6 groupid...

CVE-2005-2430

Affected software: GForge (notebook mentions GForge 4.5). Vulnerability: Multiple cross-site scripting (XSS) flaws in GForge that allow remote injection of web script/HTML via various parameters (forum_id, group_id, project_task_id, id, search text, qrs.php, form/rows/cols/wrap in notepad.php, an...

CVE-2005-2431

The CVE-2005-2431 entry concerns GForge 4.5 where the (1) lost password and (2) account pending features fail to enforce a limit on outbound emails, allowing a remote attacker to perform a mail flood (send large numbers of messages to arbitrary addresses). Affected component is the email sending ...

Cross Site Scripting vulnerabilities in GForge

--------------------------------------------------------------------------- Various Vulnerabilities in GForge --------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2005 Location: Basque Country...

GForge <= 4.5 Multiple Script XSS

The remote host is running GForge, an open source software development collaborative toolset using PHP and PostgreSQL. The installed version of GForge on the remote host fails to properly sanitize user-supplied input to several parameters / scripts before using it in dynamically-generated pages. ...

[SA16253] GForge Cross-Site Scripting Vulnerabilities

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

gforge -- XSS and email flood vulnerabilities

Jose Antonio Coret reports that GForge contains multiple Cross Site Scripting vulnerabilities and an e-mail flood vulnerability: The login form is also vulnerable to XSS Cross Site Scripting attacks. This may be used to launch phising attacks by sending HTML e-mails i.e.: saying that you need to...

FreeBSD : gforge -- directory traversal vulnerability (fe903533-ff96-4c7a-bd3e-4d40efa71897)

An STG Security Advisory reports : GForge CVS module made by Dragos Moinescu and another module made by Ronald Petty have a directory traversal vulnerability. ... malicious attackers can read arbitrary directory lists. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and...

Gforge - viewFile.php security flaw

-------------------------------------------------------------------------- Vendor : Gforge http://gforge.org Product : gforge Affected versions : 4.0 Bug fixed : = 4.0 & Debian pkg 3.1-30 Vulnerability : Input validation flaw Problem-Type : remote Severity : High, arbitrary command execution Auth...