DSA-2332-1 python-django - several issues

Bulletin has no description...

Sql injection

SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a send action...

CVE-2010-4897

CVE-2010-4897 is a SQL injection vulnerability affecting BlueCMS 1.6, specifically in comment.php. An attacker could send crafted requests via the X-Forwarded-For HTTP header in a send action to execute arbitrary SQL commands. This is supported by multiple sources (NVD, Red Hat, CVE records). The...

CVE-2010-4897: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in comment.php in BlueCMS 1.6 allows remote attackers to execute arbitrary SQL commands via the X-Forwarded-For HTTP header in a send action...

PT-2011-1832

Name of the Vulnerable Software and Affected Versions BlueCMS version 1.6 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the X-Forwarded-For HTTP header in a send action to the comment.php file. Recommendations For BlueCMS version 1.6, consid...

The Django development framework multiple security vulnerabilities-vulnerability warning-the black bar safety net

Affected version: Django 1.2.5 Django 1.3 beta 1 Django 1.2.4 Django 1.2.2 Django 1.2 Vulnerability description: Django is an open source Web application framework made of Python written. Django there are multiple security vulnerabilities, allow an attacker to obtain sensitive information,...

Django开发框架多个安全漏洞

Bugtraq ID: 49573 Django是一款开放源代码的Web应用框架，由Python写成。 Django存在多个安全漏洞，允许攻击者获得敏感信息，操作数据，进行缓存毒药攻击或进行拒绝服务攻击。 1当使用缓存后端时django.contrib.sessions中处理会话存在错误，可被利用操作会话信息。要成功个利用漏洞需要已知会话KEY和应用程序允许攻击者使用合法会话KEY储存字典类对象到缓冲中。 2Django模型系统包括一个字段类型-- URLField...

DEBIAN-CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...

CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...

CVE-2011-3187

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...

CVE-2011-3187: Improper Input Validation

The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address...

PT-2011-4299

Name of the Vulnerable Software and Affected Versions Ruby on Rails version 3.0.5 Description The issue concerns the to s method in actionpack/lib/action dispatch/middleware/remote ip.rb, which fails to validate the X-Forwarded-For header in requests from IP addresses on a Class C network. This...

STCMS V3. 3 SQL injection 0DAY vulnerabilities-vulnerability warning-the black bar safety net

Vulnerability causes: There is no filter$SERVER lead to the user can be faked$SERVERX-FORWARDED-FOR, so the malicious injection statement written to the database. Using the steps of: 1. Enter a comment on the page, the first comment A and capture. 2. In the package add a bar: X-Forwarded-For:...

Rails 3.0.5 Log File Injection Proof Of Concept

Encoding: UTF-8 Log-File-Injection - Ruby on Rails 3.05 possibilities: - possible date back attacks tried with request-log-analyzer: worked but teasercheckwarnings - ip spoofing - binary log-injections - DOS if ip is used with an iptables-ban-script !! works only on intranet apps !! Fix: validate...

Ruby on Rails 3.0.5 - WEBrick::HTTPRequest Module HTTP Header Injection

Ruby on Rails 3.0.5 - WEBrick::HTTPRequest Module HTTP Header Injection source: https://www.securityfocus.com/bid/46423/info Ruby on Rails is prone to a vulnerability that allows attackers to inject arbitrary content into the 'X-Forwarded-For', 'X-Forwarded-Host' and 'X-Forwarded-Server' HTTP...

PT-2011-2407

Name of the Vulnerable Software and Affected Versions Contao CMS versions prior to 2.9.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the HTTP X FORWARDED FOR header. This header is stored by system/libraries/Environment.php but n...

Design/Logic Flaw

The PiwikCommon::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via 1 use of a private aka RFC 1918 address behind a proxy server or 2 spoofing of the X-Forwarded-For HTTP...

PT-2011-2319

Name of the Vulnerable Software and Affected Versions Piwik versions prior to 1.1 Description The issue allows remote attackers to bypass intended geolocation and logging functionality. This can be achieved by either using a private address behind a proxy server or by spoofing the X-Forwarded-For...

CVE-2011-0398: Undefined Security Weakness

The PiwikCommon::getIP function in Piwik before 1.1 does not properly determine the client IP address, which allows remote attackers to bypass intended geolocation and logging functionality via 1 use of a private aka RFC 1918 address behind a proxy server or 2 spoofing of the X-Forwarded-For HTTP...

IPfucK -- A Proxy tool for Firefox -- New Version

Having your IP address considered as private from a legal point of view, it is always interesting to increase your on-line privacy. Not only to hide your illegal activity indeed for most politicians and anti-fraud organizations, behind each surfers lives, but to just keep your personal informatio...