Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the 1 commentName, 2 commentEmail, 3 commentWeb, or 4 commentText parameter to article.php; and allow remote authenticated administrators to inject arbitrary web script or...

Default credentials

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

Design/Logic Flaw

article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service blog spam via a comment=new action...

CVE-2009-4909

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

CVE-2009-4904

article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service blog spam via a comment=new action...

CVE-2009-4909

The provided documents identify CVE-2009-4909 as a vulnerability in oBlog’s admin/index.php that allows remote attackers to perform brute-force password guessing via HTTP requests. This mode cites concrete details: affected component is the oBlog admin login, and the root cause is insufficient pr...

CVE-2009-4904

The CVE-2009-4904 issue affects the oBlog platform where article.php does not properly restrict comments, enabling remote attackers to trigger a denial of service (blog spam) through a comment=new action. The description does not specify affected versions or exact code root cause beyond insuffici...

CVE-2009-4903

CVE-2009-4903 describes a Cross-site Scripting (XSS) flaw in the web app oBlog . The vulnerability is in the file index.php and is exploitable via the search parameter , allowing remote attackers to inject arbitrary script/HTML. The NVD entry notes a non-authoritative provenance (“NOTE: the prove...

CVE-2009-4903

Cross-site scripting XSS vulnerability in index.php in oBlog allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2009-4907

CVE-2009-4907 describes multiple CSRF vulnerabilities in oBlog that allow remote attackers to hijack administrator sessions and perform admin actions such as changing passwords, forcing logouts, altering post visibility, removing links, and changing blog name fields. The initial records do not sp...

CVE-2009-4908

CVE-2009-4908 describes multiple cross-site scripting (XSS) vulnerabilities in the oBlog platform. The issues enable remote attackers to inject arbitrary script/HTML via the following parameters: article.php (commentName, commentEmail, commentWeb, commentText); admin/write.php (article_id, title)...

CVE-2009-4907

Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...

CVE-2009-4909: Improper Authentication

admin/index.php in oBlog allows remote attackers to conduct brute-force password guessing attacks via HTTP requests...

CVE-2009-4907: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in oBlog allow remote attackers to hijack the authentication of administrators for requests that 1 change the admin password, 2 force an admin logout, 3 change the visibility of posts, 4 remove links, and 5 change the name fields of a blog...

CVE-2009-4908: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in oBlog allow remote attackers to inject arbitrary web script or HTML via the 1 commentName, 2 commentEmail, 3 commentWeb, or 4 commentText parameter to article.php; and allow remote authenticated administrators to inject arbitrary web script or...

CVE-2009-4904: Undefined Security Weakness

article.php in oBlog does not properly restrict comments, which allows remote attackers to cause a denial of service blog spam via a comment=new action...

CVE-2009-4903: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in oBlog allows remote attackers to inject arbitrary web script or HTML via the search parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

oBlog Persistant XSS, CSRF, Admin Bruteforce

No description provided by source. ------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic...

oBlog Persistant XSS CSRF Admin Bruteforce

No description provided by source. ------------------------------------------------------------------------------------------------- Application: oBlog Version: the only one there is : Download: http://www.dootzky.com/images/projects/oBlog.zip Author of this full disclosure: Milos Zivanovic...