Improper access control

The projectissueaccess function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access control modules and obtain attached files by guessing the filename, and obtain issue information via direct requests...

CVE-2007-0505

Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue...

CVE-2007-0505

Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue...

CVE-2007-0506

The CVE-2007-0506 entry concerns Drupal’s Project issue tracking module (versions 4.7.0–5.x before 20070123). The vulnerability allows remote authenticated users to bypass other access control modules and access attached files by guessing filenames, and to retrieve issue information through direc...

Project and Project issue tracking - Multiple vulnerabilities

Multiple vulnerabilities have been discovered and fixed in the Project and Project issue tracking modules: Access bypass in Project issue tracking Due to an error in the projectissueaccess function, users with the 'Access project issues' permission would have full access to all issues on a site,...

CVE-2006-6646

Multiple cross-site scripting XSS vulnerabilities in Drupal 1 Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and 2 Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the checkplain function...

DSA-1208-1 bugzilla

Bulletin has no description...

ProgSys verion 0.151 XSS vulnerability

25/10/06 Vigilon Advisory http://www.vigilon.com/advisories/vg-progsys-24-10-2006.txt ------------------------------------------------------- Application: ProgSys Web Site: http://www.boesch-it.de/sw/php-scripts/progsys/english/download.php Versions: 0.151 and below Platform: linux, windows,...

Security Advisory for Bugzilla 2.18.5, 2.20.2, 2.22, and 2.23.2

Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers six security issues that have recently been fixed in the Bugzilla code: + Sometimes the information put into the h1 and h2 tags in Bugzilla was not properly escaped,...

Debian DSA-944-1 : mantis - several vulnerabilities

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-4238 Missing input sanitising allows remote attackers to inject arbitrary web script or HTML. -...

Debian DSA-905-1 : mantis - several vulnerabilities

Several security related problems have been discovered in Mantis, a web-based bug tracking system. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2005-3091 A cross-site scripting vulnerability allows attackers to inject arbitrary web script or HTML. -...

Debian DSA-1133-1 : mantis - missing input sanitising

Several remote vulnerabilities have been discovered in the Mantis bug tracking system, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-0664 A cross-site scripting vulnerability was discovered ...

DSA-1133-1 mantis - cross site scripting

Bulletin has no description...

Linux kernel fails to properly handle malformed SCTP packets

Overview It is possible to cause a denial of service of the Linux kernel by sending a SCTP packet containing no chunks. Description The Stream Control Transmission Protocol SCTP, RFC 2960 is a transport layer protocol which provides reliable, sequential transport of message streams with congestio...

CVE-2006-3257

Multiple cross-site scripting XSS vulnerabilities in Claroline 1.7.7 allow remote attackers to inject arbitrary HTML or web script via unspecified attack vectors, possibly including 1 calendar/myagenda.php, 2 document/document.php, 3 phpbb/newtopic.php, 4 tracking/userLog.php, and 5 wiki/page.php...

CVE-2006-2795

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

CVE-2006-2795

CVE-2006-2795 affects XiTi Tracking Script versions 6 and 7 RC. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML via the (1) xtref parameter in xiti.js and (2) an HTTP Referer header field. The note indi...

CVE-2006-2795

Multiple cross-site scripting XSS vulnerabilities in XiTi Tracking Script 6 and 7 RC allow remote attackers to inject arbitrary web script or HTML via 1 the xtref parameter in xiti.js and 2 an HTTP Referer header field. NOTE: the provenance of this information is unknown; the details are obtained...

Mail Multiple Information Disclosure — Mozilla

As a privacy measure to prevent senders primarily spammers from tracking when e-mail is read Thunderbird does not load remote content referenced from an HTML mail message until a user tells it to do so. This normally includes the content of frames and CSS files, but CrashFr showed it was possible...