[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0812162129450.5724@faron.mitre.org>
Date: Tue, 16 Dec 2008 21:30:12 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: Steven Christey <coley@...us.mitre.org>
Subject: Re: CVE request: Four issues in PunBB
Three CVE's are assigned because the two SQL injections also affect the
same product versions.
- Steve
======================================================
Name: CVE-2008-5433
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5433
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#possible_xss_in_login
Cross-site scripting (XSS) vulnerability in login.php in PunBB 1.3 and
1.3.1 allows remote attackers to inject arbitrary web script or HTML
via the password field.
======================================================
Name: CVE-2008-5434
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5434
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_at_adminusers.php_page
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_in_adminsettings.php_via_configuration_values
Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow
remote authenticated administrators to execute arbitrary SQL commands
via the (1) order_by or (2) direction parameter to admin/users.php, or
(3) configuration options to admin/settings.php.
======================================================
Name: CVE-2008-5435
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5435
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Cross-site scripting (XSS) vulnerability in moderate.php in PunBB
before 1.3.1 allows remote attackers to inject arbitrary web script or
HTML via a topic subject.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
