Serendipity Blog vuln

I found this while auditing serendipty blog. You need a blog account which isnt that big of deal just google all the sites that give out free blogs for this to work. After you get hte blog account you go into your admin panel where there will be config options. The mysql details are editable from...

Ubuntu 4.10 / 5.04 : php4, php4-universe vulnerability (USN-147-1)

A remote code execution vulnerability has been discovered in the XMLRPC module of the PEAR PHP Extension and Application Repository extension of PHP. By sending specially crafted XMLRPC requests to an affected web server, a remote attacker could exploit this to execute arbitrary code with the web...

Serendipity XSS Flaw

The remote version of Serendipity is vulnerable to cross-site scripting attacks due to a lack of sanity checks on the 'searchTerm' parameter in the 'compat.php' script. With a specially crafted URL, an attacker can cause arbitrary code execution in a user's browser resulting in a loss of integrit...

Serendipity < 0.7.1 XSS Vulnerability - Active Check

The remote version of Serendipity is vulnerable to cross-site scripting attacks due to a lack of sanity checks on the SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2004-2525

Cross-site scripting XSS vulnerability in compat.php in Serendipity before 0.7.1 allows remote attackers to inject arbitrary web script or HTML via the searchTerm variable...

CVE-2004-2525

CVE-2004-2525 affects Serendipity prior to 0.7.1: a cross-site scripting vulnerability in compat.php allows an attacker to inject script via the searchTerm parameter. Reported in multiple feeds (NVD/OpenVAS), with impact described as browser-level integrity risk (I:P) and no confidentiality impac...

CVE-2005-3129

Cross-site request forgery CSRF vulnerability in Serendipity 0.8.4 and earlier allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag to serendipityadmin.php...

CVE-2005-3129

Cross-site request forgery CSRF vulnerability in Serendipity 0.8.4 and earlier allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag to serendipityadmin.php...

CVE-2005-3129

CVE-2005-3129 describes a CSRF vulnerability in Serendipity 0.8.4 and earlier. The issue allows remote attackers to perform unauthorized actions as a logged-in user through a link or an IMG tag to serendipity_admin.php. The supplied documents do not provide remediation steps or patch/version deta...

[Full-disclosure] Serendipity: Account Hijacking / CSRF Vulnerability

=========================================================== Serendipity: Account Hijacking / CSRF Vulnerability =========================================================== Technical University of Vienna Security Advisory TUVSA-0509-001, September 29, 2005...

CVE-2004-2157

Cross-site scripting XSS vulnerability in Comment.php in Serendipity 0.7 beta1, and possibly other versions before 0.7-beta3, allows remote attackers to inject arbitrary HTML and PHP code via the 1 email or 2 username field...

CVE-2004-2158

The CVE-2004-2158 entry describes a SQL injection in Serendipity 0.7-beta1, exploitable via the entry_id parameter to exit.php or comment.php. The root cause is improper sanitization of user input, allowing remote attackers to execute arbitrary SQL commands and potentially alter or retrieve data....

CVE-2004-2158

SQL injection vulnerability in Serendipity 0.7-beta1 allows remote attackers to execute arbitrary SQL commands via the entryid parameter to 1 exit.php or 2 comment.php...

CVE-2004-2157

The CVE-2004-2157 entry describes a cross-site scripting (XSS) vulnerability in Serendipity 0.7 beta1 (and possibly earlier versions before 0.7-beta3) in the Comment.php component. The flaw allows remote attackers to inject arbitrary HTML and PHP code via the (1) email or (2) username field, impa...

security flaw

Eval injection vulnerability in PEAR XMLRPC 1.3.0 and earlier aka XML-RPC or xmlrpc and PHPXMLRPC aka XML-RPC For PHP or php-xmlrpc 1.1 and earlier, as used in products such as 1 WordPress, 2 Serendipity, 3 Drupal, 4 egroupware, 5 MailWatch, 6 TikiWiki, 7 phpWebSite, 8 Ampache, and others, allows...

USN-147-1: PHP XMLRPC vulnerability

A remote code execution vulnerability has been discovered in the XMLRPC module of the PEAR PHP Extension and Application Repository extension of PHP. By sending specially crafted XMLRPC requests to an affected web server, a remote attacker could exploit this to execute arbitrary code with the web...

[SA15862] Serendipity XML-RPC Unspecified PHP Code Execution Vulnerability

---------------------------------------------------------------------- Bist Du interessiert an einem neuen Job in IT-Sicherheit? Secunia hat zwei freie Stellen als Junior und Senior Spezialist in IT- Sicherheit: http://secunia.com/secuniavacancies/...

Mandrake Linux Security Advisory : php-pear (MDKSA-2005:109)

A vulnerability was discovered by GulfTech Security in the PHP XML RPC project. This vulnerability is considered critical and can lead to remote code execution. The vulnerability also exists in the PEAR XMLRPC implementation. Mandriva ships with the PEAR XMLRPC implementation and it has been...

Advisory 02/2005: Remote code execution in Serendipity

Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Remote code execution in Serendipity Release Date: 2005/06/29 Last Modified: 2005/06/29 Author: Christopher Kunz [email protected] Application: Serendipity = 0.8.2 Severity: Arbitrary remote code execution...

Serendipity XML-RPC for PHP Remote Code Injection

The version of Serendipity installed on the remote host is prone to remote code execution due to a failure of its bundled XML-RPC library to sanitize user-supplied input to the 'serendipityxmlrpc.php' script. This flaw may allow attackers to execute code remotely subject to the privileges of the...