CVE-2008-3328

CVE-2008-3328 : Trac’s wiki engine before 0.10.5 has a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script via unknown vectors. Connected advisories confirm the issue is shell-agnostic to input points in the wiki engine prior to 0.10.5. The available r...

CVE-2005-4644

CVE-2005-4644 is a cross-site scripting (XSS) vulnerability in the HTML WikiProcessor of Edgewall Trac 0.9.2. It allows remote attackers to inject arbitrary script/HTML via the SRC attribute of an IMG tag. The connected Debian OpenVAS/DSA entries note fixes in Trac upgrades: trac 0.8.1-3sarge4 (s...

CVE-2006-3695

Trac up to 0.9.5/0.9.6 era vulnerability: enabling reStructuredText functionality via docutils allows remote access to read arbitrary files, possible XSS, and denial of service due to not disabling the raw/include commands for untrusted users. No patch/version details are provided in the supplied...

CVE-2005-2147

CVE-2005-2147 concerns Trac prior to 0.8.4. Multiple connected sources confirm a flaw where an attacker can read or upload arbitrary files by supplying a full pathname in the id parameter to the upload or attachment viewer scripts. The vulnerability enables remote access to files and, in some con...

CVE-2005-4065

CVE-2005-4065 is a SQL injection vulnerability in the Trac search module, affecting Trac prior to 0.9.2. The root cause is missing input sanitisation that allows an attacker to inject arbitrary SQL. The impact is remote code execution on the database level (partial confidentiality, integrity, and...

CVE-2007-1405

CVE-2007-1405 is a Cross-site Scripting (XSS) vulnerability in Trac’s "download wiki page as text" feature. The issue arises when using Microsoft Internet Explorer and allows remote attackers to inject arbitrary web script or HTML via unspecified parameters. Affected is Trac prior to version 0.10...

CVE-2005-2007

CVE-2005-2007 describes a directory-traversal vulnerability in Edgewall Trac 0.8.3 and earlier. The issue permits remote attackers to read or write arbitrary files by supplying a double-dot path in the id parameter to the (1) upload or (2) attachment scripts. The initial and connected data consis...

CVE-2006-5878

CVE-2006-5878 is described across multiple connected sources as a cross-site request forgery (CSRF) flaw in Trac, affecting 0.10 and earlier releases. The underlying issue is insufficient validation of HTTP requests, enabling an attacker to perform actions on behalf of an authenticated Trac user ...

CVE-2007-1406

CVE-2007-1406 affects Trac before 0.10.3.1. The issue is that Trac did not send a Content-Disposition HTTP header specifying an attachment in certain “unsafe” situations, with the impact and remote attack vectors described as unknown in the sources. The connected records confirm Trac’s version ga...

CVE-2005-3980

CVE-2005-3980 describes an SQL injection in Edgewall Trac’s ticket query module, exploitable via the group parameter. The vulnerability affects Trac 0.9 and possibly earlier, enabling remote SQL commands to be executed. Multiple sources (NVD, OSV, OpenVAS, and OSV detail entries) corroborate the ...

CVE-2005-4305

CVE-2005-4305 describes a cross-site scripting (XSS) vulnerability in Edgewall Trac versions 0.9, 0.9.1, and 0.9.2 where un-sanitized URL data is reflected in an error page. The root cause is inadequate sanitization of URL input, enabling remote attackers to inject arbitrary script or HTML. Publi...

CVE-2006-2106

Trac 0.9.4 and earlier contain a cross-site scripting (XSS) vulnerability in the wiki macro, allowing a remote attacker to inject arbitrary script/HTML in the browser. Upgrade to Trac 0.9.5 per Edgewall’s advisory/blog referenced in the sources to mitigate.