EUVD-2013-7028

Malware in sbrugna...

EUVD-2011-5168

Malware in sbrugna...

EUVD-2013-7029

Malware in sbrugna...

CVE-2011-5269

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

ProjectForge跨站请求伪造和跨站脚本漏洞

ProjectForge是一个基于Web的项目管理解决方案包括:工时表Timesheet、费用管理、项目甘特图,控制和管理工程分解结构。 1 某些未明输入在用于JSON自动完成响应前未能正确过滤，攻击者可以在用户访问恶意数据时，利用漏洞在用户浏览器会话上下文中注入任意HTML和脚本代码。 2程序允许用户不进行适当的有效性检查，通过HTTP请求执行某些操作。当登录的用户访问特制的网页时，攻击者可以执行某些未指定的操作。 0 ProjectForge 5.x ProjectForge 5.3版本以修复此漏洞，建议用户下载使用： http://www.projectforge.org/...

CVE-2013-7250

Cross-site scripting XSS vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java...

CVE-2013-7251

Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...

CVE-2011-5269

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

Cross site scripting

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

Cross site scripting

Cross-site scripting XSS vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...

CVE-2013-7251

CVE-2013-7251 concerns CSRF vulnerabilities in ProjectForge prior to version 5.3, enabling remote attackers to hijack user authentication via multiple web paths (web/admin/, web/core/, web/dialog/, web/fibu/, web/mobile/, web/task/, web/wicket/). Affected product: ProjectForge; affected component...

CVE-2011-5269

CVE-2011-5269 affects ProjectForge prior to 3.5.3, where remote authenticated users can inject arbitrary web script or HTML through a validation message (XSS). The issue arises in the validation/message handling, enabling script execution in an authenticated user’s context. No exploitation detail...

CVE-2013-7250

CVE-2013-7250: XSS in ProjectForge (JsonBuilder) before 5.3 allows remote authenticated users to inject scripts via an autocompletion string. Affected: web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java. Impact: cross-site scripting; fix/mitigation: upgrade to 5.3...

CVE-2013-7250

Cross-site scripting XSS vulnerability in the JsonBuilder implementation in ProjectForge before 5.3 allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion string, related to web/core/JsonBuilder.java and web/wicket/autocompletion/PFAutoCompleteBehavior.java...

CVE-2013-7251

Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...

CVE-2011-5269

Cross-site scripting XSS vulnerability in ProjectForge before 3.5.3 allows remote authenticated users to inject arbitrary web script or HTML via a validation message...

CVE-2013-7251: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ProjectForge before 5.3 allow remote attackers to hijack the authentication of arbitrary users via vectors related to 1 web/admin/, 2 web/core/, 3 web/dialog/, 4 web/fibu/, 5 web/mobile/, 6 web/task/, or 7 web/wicket/...

PT-2014-3305

Name of the Vulnerable Software and Affected Versions ProjectForge versions prior to 5.3 Description A cross-site scripting XSS issue exists due to an improper implementation in the JsonBuilder. This allows remote authenticated users to inject arbitrary web script or HTML via an autocompletion...

PT-2014-2186

Name of the Vulnerable Software and Affected Versions ProjectForge versions prior to 3.5.3 Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via a validation message. Recommendations For versions prior to 3.5.3, update to version...