EUVD-2007-3672

Malware in sbrugna...

DotClear 1.2.x /tools/thememng/index.php tool_url Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/23411/info DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browse...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the 1 toolurl parameter to ecrire/tools.php and multiple fields on the 2 blogconf, 3 blogroll, 4 ecrire/redacteur.php, and 5 ecrire/userprefs.php pages...

CVE-2007-1989

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...