CVE-2007-2808

CVE-2007-2808 affects gnatsweb/gnatsweb.pl in Gnatsweb 4.00 and Gnats 4.1.99, where inadequate sanitization of the database parameter in the main CGI script allows remote XSS via arbitrary HTML/script. Debian's DSA-1486-1 notes the fix in gnatsweb 4.00-1etch1, indicating remediation by upgrading ...

CVE-2004-0623

GNU GNATS 4.00 is affected by a format string vulnerability in misc.c that can allow a remote attacker to execute arbitrary code via format specifiers in a string logged by syslog. The CVE-2004-0623 entry notes a high severity (base score 10.0, CVSS2: AV:N/AC:L/Au:N/C:C/I:C/A:C) with remote, unau...

CVE-2005-2180

CVE-2005-2180 concerns the GNATS generator, where in GNATS 4.0/4.1.0 (and possibly earlier) if the binary is installed setuid, it fails to properly validate files passed to the -o option and opens the target with write access, enabling a local user to overwrite arbitrary files. This is the core c...