410 matches found
bugzilla -- two SQL injections, sensitive data exposure
A Bugzilla Security Advisory reports: It is possible to inject raw SQL into the Bugzilla database via the "Bug.create" and "Bug.search" WebService functions. When a user would change his password, his new password would be exposed in the URL field of the browser if he logged in right after changi...
JVN#80436657 Webservice-DIC yoyaku_v41 vulnerable to command injection
yoyakuv41 from Webservice-DIC is a software to manage conference room reservations. yoyakuv41 contains a command injection vulnerability. Impact An arbitrary command could be executed with the privilege of the server where yoyakuv41 runs. Solution Update the Software Update to the latest version...
CVE-2009-1553
Multiple cross-site scripting XSS vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to 1 applications/applications.jsf, 2 configuration/configuration.jsf, 3 customMBeans/customMBeans.jsf, ...
GlassFish Enterprise Server 2.1 - Admin Console webServicewebServicesGeneral.jsf URI Cross-Site Scripting
GlassFish Enterprise Server 2.1 - Admin Console webServicewebServicesGeneral.jsf URI Cross-Site Scripting source: https://www.securityfocus.com/bid/34824/info GlassFish Enterprise Server is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize...
Jboss dir.traversal
JBossAS 5.0.1GA Simple webservice "hello" from docs + imported XSD-schema. Any user can get ANY XML from server: http://127.0.0.1:8080/echo/Echo?wsdl&resource=../../../conf/login-config.xml...
Webservice-DIC shop_v50 and shop_v52 vulnerable to cross-site scripting
Overview Webservice-DIC shopv50 and shopv52 contain a cross-site scripting vulnerability. Webservice-DIC shopv50 and shopv52 are shopping cart software. shopv50 and shopv52 contain a cross-site scripting vulnerability. Shuya Ueki reported this vulnerability to IPA. JPCERT/CC coordinated with the...
JVN#79914432 Webservice-DIC shop_v50 and shop_v52 vulnerable to cross-site scripting
Webservice-DIC shopv50 and shopv52 are shopping cart software. shopv50 and shopv52 contain a cross-site scripting vulnerability. Impact This vulnerability can be exploited to conduct a cross-site scripting attack by an attacker. Solution Update the Software Administrators of the websites which us...
Design/Logic Flaw
The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check...
CVE-2008-2104
The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check...
CVE-2008-2104
The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check...
CVE-2008-2104
The CVE-2008-2104 entry concerns Bugzilla 3.1.3’s WebService: remote authenticated users lacking canconfirm privileges can create NEW or ASSIGNED bug entries via XML-RPC, bypassing the canconfirm check. The connected documents confirm the affected product/version and the bypass directly enabling ...
CVE-2008-2104
The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface, which bypasses the canconfirm check...
Logs visualization in WS_FTP Server Manager 6.1.0.0
Luigi Auriemma Application: WSFTP Server Manager http://www.wsftp.com Versions: WSFTP Server = 6.1.0.0 Platforms: Windows Bugs: A authorization bypassing in log visualization B ASP source visualization Exploitation: remote Date: 06 Feb 2008 Author: Luigi Auriemma e-mail: [email protected] web:...
Design/Logic Flaw
The offeraccountbyemail function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation...
FreeBSD : bugzilla -- multiple vulnerabilities (75231c63-f6a2-499d-8e27-787773bda284)
A Bugzilla Security Advisory reports : This advisory covers three security issues that have recently been fixed in the Bugzilla code : - A possible cross-site scripting XSS vulnerability when filing bugs using the guided form. - When using emailin.pl, insufficiently escaped data may be passed to...
CVE-2007-5038
CVE-2007-5038 affects Bugzilla WebService: offer_account_by_email in User.pm does not validate the createemailregexp parameter, permitting remote creation of accounts that would be denied by the email regexp. Affected versions are Bugzilla before 3.0.2 and 3.1.x before 3.1.2. Exploitation would b...
CVE-2007-5038
The offeraccountbyemail function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation...
Security Advisory for Bugzilla 3.0.1 and 3.1.1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers a critical security issue that has recently been fixed in the Bugzilla code: Even with account creation disabled, users can...
Bugzilla < 3.0.2 / 3.1.2 WebService/User.pm Authentication Bypass
Binary data 4219.prm...
bugzilla -- "createmailregexp" security bypass vulnerability
The Bugzilla development team reports: Bugzilla::WebService::User::offeraccountbyemail does not check the "createemailregexp" parameter, and thus allows users to create accounts who would normally be denied account creation. The "emailregexp" parameter is still checked. If you do not have the...