CVE-2007-3423

cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the From field of an instant message as the beginning of the .dat file name when the 1 imview2 or 2 imview3 function reads a an internal IM, or a message from a b guest or c removed member, which has unknown impact and...

Design/Logic Flaw

The editprofile3 function in cgi-bin/cgi-lib/user.pl in web-app.org WebAPP before 0.9.9.7 does not properly check the 1 themes.dat, 2 languages.dat, 3 profession.dat, 4 gen.dat, 5 marstat.dat, 6 states.dat, and 7 ages.dat files before saving profile settings of members, which has unknown impact a...

Design/Logic Flaw

The getcgi function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 attempts to parse query strings that contain 1 non-printing characters, 2 certain printing characters that do not commonly occur in URLs, or 3 invalid URL encoding sequences, which has unknown impact and remote...

CVE-2007-3418

The displaypost function in cgi-bin/cgi-lib/forumdisplay.pl in web-app.org WebAPP before 0.9.9.7 does not display usernames in conjunction with real names, which makes it easier for remote authenticated users to impersonate other users...

CVE-2007-3421

The 1 login, 2 admin profile edit, 3 reminder, 4 edit profile, 5 profile view, 6 gallery view, 7 gallery comment, and 8 gallery feedback capabilities in web-app.org WebAPP before 0.9.9.7 do not verify presence of users in memberlist.dat, which has unknown impact and remote attack vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the administration of 1 polls, 2 profiles, 3 IP bans, and 4 forums in a web-app.org WebAPP 0.8 through 0.9.9.6; and b web-app.net WebAPP 0.9.9.3.3, 0.9.9.3.4, and 2007; allow remote attackers to perform deletions as administrators...

CVE-2007-3419

The editprofile3 function in cgi-bin/cgi-lib/user.pl in web-app.org WebAPP before 0.9.9.7 does not properly check the 1 themes.dat, 2 languages.dat, 3 profession.dat, 4 gen.dat, 5 marstat.dat, 6 states.dat, and 7 ages.dat files before saving profile settings of members, which has unknown impact a...

CVE-2007-3421

The 1 login, 2 admin profile edit, 3 reminder, 4 edit profile, 5 profile view, 6 gallery view, 7 gallery comment, and 8 gallery feedback capabilities in web-app.org WebAPP before 0.9.9.7 do not verify presence of users in memberlist.dat, which has unknown impact and remote attack vectors...

CVE-2007-3419

The editprofile3 function in cgi-bin/cgi-lib/user.pl in web-app.org WebAPP before 0.9.9.7 does not properly check the 1 themes.dat, 2 languages.dat, 3 profession.dat, 4 gen.dat, 5 marstat.dat, 6 states.dat, and 7 ages.dat files before saving profile settings of members, which has unknown impact a...

CVE-2007-3423

cgi-bin/cgi-lib/instantmessage.pl in web-app.org WebAPP before 0.9.9.7 uses the From field of an instant message as the beginning of the .dat file name when the 1 imview2 or 2 imview3 function reads a an internal IM, or a message from a b guest or c removed member, which has unknown impact and...

CVE-2007-3424

The affected software is WebAPP (Web-app.org) prior to version 0.9.9.7. The vulnerability lies in the moveim function of cgi-bin/cgi-lib/instantmessage.pl, which uses the tocat parameter as a subdirectory name when moving an instant message. The underlying impact is described as unknown in the so...

CVE-2007-3422

The getcgi function in cgi-bin/cgi-lib/subs.pl in web-app.org WebAPP before 0.9.9.7 attempts to parse query strings that contain 1 non-printing characters, 2 certain printing characters that do not commonly occur in URLs, or 3 invalid URL encoding sequences, which has unknown impact and remote...

CVE-2007-3417

CVE-2007-3417 covers multiple XSS vulnerabilities in the WebAPP web-app.org CGI module: cgi-bin/cgi-lib/search.pl, where a non-sanitized search string is echoed into an HREF attribute by process_search or show_recent_searches. The issue affects WebAPP prior to version 0.9.9.7 and allows remote at...

CVE-2007-3423

CVE-2007-3423 affects WebAPP (web-app.org) WebAPP versions before 0.9.9.7. The vulnerable component is cgi-bin/cgi-lib/instantmessage.pl, where the From field of an instant message is used as the beginning of the .dat filename when the imview2 or imview3 function reads messages from an internal I...

CVE-2007-3418

The displaypost function in cgi-bin/cgi-lib/forumdisplay.pl in web-app.org WebAPP before 0.9.9.7 does not display usernames in conjunction with real names, which makes it easier for remote authenticated users to impersonate other users...

CVE-2007-3420

The CVE concerns WebAPP (web-app.org) prior to version 0.9.9.7, where the Random Cookie Password feature in the loaduser function (cgi-bin/cgi-lib/subs.pl) fails to clear four cookies (username, password, usertheme, userlang) for unauthorized users. This creates a potential, described as having u...

CVE-2007-3422

WebAPP (web-app.org) before 0.9.9.7 is affected by CVE-2007-3422. The getcgi function in cgi-bin/cgi-lib/subs.pl parses query strings containing (1) non‑printing characters, (2) certain printing characters not common in URLs, or (3) invalid URL encoding sequences. Impact is stated as unknown with...

CVE-2007-3242

The CVE-2007-3242 entry concerns the Menu Manager Mod for WebAPP WebAPP NE (versions 0.9.9.3.3–0.9.9.8) and WebAPP.org WebAPP before 0.9.9.6. The vulnerability allows remote authenticated users to execute arbitrary commands by injecting shell metacharacters into the titles of items in a personal ...

CVE-2007-1827

Multiple unspecified vulnerabilities in form input validation in web-app.org WebAPP before 0.9.9.6 allow remote authenticated users to corrupt data files, gain access to private files, and execute arbitrary code via "certain characters."...

Design/Logic Flaw

web-app.org WebAPP before 0.9.9.6 allows remote authenticated users to upload certain files 1 via a crafted filename or 2 by "using percent encoding in forms."...