[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] CVE request: Four issues in PunBB
From:       "Steven M. Christey" <coley () linus ! mitre ! org>
Date:       2008-12-17 2:30:12
Message-ID: Pine.GSO.4.51.0812162129450.5724 () faron ! mitre ! org
[Download RAW message or body]


Three CVE's are assigned because the two SQL injections also affect the
same product versions.

- Steve

======================================================
Name: CVE-2008-5433
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5433
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#possible_xss_in_login

Cross-site scripting (XSS) vulnerability in login.php in PunBB 1.3 and
1.3.1 allows remote attackers to inject arbitrary web script or HTML
via the password field.


======================================================
Name: CVE-2008-5434
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5434
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_at_adminusers.php_page
                
Reference: CONFIRM:http://punbb.informer.com/wiki/punbb13/bugs#potential_sql-injections_in_adminsettings.php_via_configuration_values


Multiple SQL injection vulnerabilities in PunBB 1.3 and 1.3.1 allow
remote authenticated administrators to execute arbitrary SQL commands
via the (1) order_by or (2) direction parameter to admin/users.php, or
(3) configuration options to admin/settings.php.


======================================================
Name: CVE-2008-5435
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5435
Reference: MLIST:[oss-security] 20081209 CVE request: Four issues in PunBB
Reference: URL:http://www.openwall.com/lists/oss-security/2008/12/09/3
Reference: CONFIRM:http://punbb.informer.com/

Cross-site scripting (XSS) vulnerability in moderate.php in PunBB
before 1.3.1 allows remote attackers to inject arbitrary web script or
HTML via a topic subject.


[prev in list] [next in list] [prev in thread] [next in thread]