Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0812162129450.5724@faron.mitre.org>
Date: Tue, 16 Dec 2008 21:30:12 -0500 (EST)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: Steven Christey <coley@...us.mitre.org>
Subject: Re: CVE request: Four issues in PunBB


Three CVE's are assigned because the two SQL injections also affect the
same product versions.

- Steve

======================================================
Name: CVE-2008-5433
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5433
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#possible_xss_in_login

Cross-site scripting (XSS) vulnerability in login.php in PunBB 1.3 and
1.3.1 allows remote attackers to inject arbitrary web script or HTML
via the password field.


======================================================
Name: CVE-2008-5434
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5434
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_at_adminusers.php_page
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_in_adminsettings.php_via_configuration_values

Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow
remote authenticated administrators to execute arbitrary SQL commands
via the (1) order_by or (2) direction parameter to admin/users.php, or
(3) configuration options to admin/settings.php.


======================================================
Name: CVE-2008-5435
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5435
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/

Cross-site scripting (XSS) vulnerability in moderate.php in PunBB
before 1.3.1 allows remote attackers to inject arbitrary web script or
HTML via a topic subject.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.