diff options
| author | Xin LI <delphij@FreeBSD.org> | 2005-03-05 15:53:41 +0000 |
|---|---|---|
| committer | Xin LI <delphij@FreeBSD.org> | 2005-03-05 15:53:41 +0000 |
| commit | 5092eea0da243c90030a440c86e4a801d11dc8e5 (patch) | |
| tree | 770802b9586b9068d0a52140655cc7c6de02ac5a /security/vuxml/vuln.xml | |
| parent | 852b94cbf0046ab30ae1a660afc066005d50cab9 (diff) | |
| download | ports-5092eea0da243c90030a440c86e4a801d11dc8e5.tar.gz ports-5092eea0da243c90030a440c86e4a801d11dc8e5.zip | |
Notes
Diffstat (limited to 'security/vuxml/vuln.xml')
| -rw-r--r-- | security/vuxml/vuln.xml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index cbac6bf79147..ca48a8cc1932 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,37 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a"> + <topic>phpbb - Insuffient check against HTML code in usercp_register.php</topic> + <affects> + <package> + <name>phpbb</name> + <range><le>2.0.13</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Neo Security Team reports:</p> + <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274"> + <p>If we specify a variable in the html code (any type: + hidden, text, radio, check, etc) with the name allowhtml, + allowbbcode or allowsmilies, is going to be on the html, + bbcode and smilies in our signature.</p> + </blockquote> + <p>This is a low risk vulnerability that allows users to bypass + forum-wide configuration.</p> + </body> + </description> + <references> + <mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274</mlist> + <mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204</mlist> + </references> + <dates> + <discovery>2005-02-29</discovery> + <entry>2005-03-05</entry> + </dates> + </vuln> + <vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae"> <topic>postnuke -- SQL injection vulnerabilities</topic> <affects> |