[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0807271839050.20336@faron.mitre.org>
Date: Sun, 27 Jul 2008 18:39:48 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE request: punbb < 1.2.19
On Mon, 21 Jul 2008, Hanno [utf-8] Böck wrote:
> * Fixed an SMTP command injection vulnerability, discovered by Stefan
> Esser.
CVE-2008-3335
> * Fixed an XSS issue in include/parser.php, discovered by Dan Crowley.
> * Fixed several potential XSS vectors in moderate.php.
Combined, these are CVE-2008-3336
> * Fixed issue with database returning the same user on multiple pages of
> the userlist, noticed by hcgtv.
This sounds like a usability issue, not a security issue.
- Steve
======================================================
Name: CVE-2008-3335
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3335
Reference: CONFIRM:http://punbb.informer.com/
Unspecified vulnerability in PunBB before 1.2.19 allows remote
attackers to inject arbitrary SMTP commands via unknown vectors.
======================================================
Name: CVE-2008-3336
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3336
Reference: CONFIRM:http://punbb.informer.com/
Multiple cross-site scripting (XSS) vulnerabilities in PunBB before
1.2.19 allow remote attackers to inject arbitrary web script or HTML
via (1) include/parser.php and (2) moderate.php.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
