diff options
| author | delphij <delphij@FreeBSD.org> | 2005-03-05 23:53:41 +0800 |
|---|---|---|
| committer | delphij <delphij@FreeBSD.org> | 2005-03-05 23:53:41 +0800 |
| commit | ce18d86d2065428cad1f7cbb8183bd61cc6ffbe7 (patch) | |
| tree | 4bc4ef577b73e134625c6cc1b8ed197b2ed8b078 /security | |
| parent | dd8b4758465c16a279f4c0700b3ee223048f5380 (diff) | |
| download | freebsd-ports-gnome-ce18d86d2065428cad1f7cbb8183bd61cc6ffbe7.tar.gz freebsd-ports-gnome-ce18d86d2065428cad1f7cbb8183bd61cc6ffbe7.tar.zst freebsd-ports-gnome-ce18d86d2065428cad1f7cbb8183bd61cc6ffbe7.zip | |
Document a low risk HTML injection (configuration bypass)
vulnerability [1] of phpBB.
(maintainer contacted and is preparing a fix)
[1] http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln.xml | 31 |
1 files changed, 31 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index cbac6bf79147..ca48a8cc1932 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,37 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="4a0b334d-8d8d-11d9-afa0-003048705d5a"> + <topic>phpbb - Insuffient check against HTML code in usercp_register.php</topic> + <affects> + <package> + <name>phpbb</name> + <range><le>2.0.13</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Neo Security Team reports:</p> + <blockquote cite="http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274"> + <p>If we specify a variable in the html code (any type: + hidden, text, radio, check, etc) with the name allowhtml, + allowbbcode or allowsmilies, is going to be on the html, + bbcode and smilies in our signature.</p> + </blockquote> + <p>This is a low risk vulnerability that allows users to bypass + forum-wide configuration.</p> + </body> + </description> + <references> + <mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110987231502274</mlist> + <mlist>http://marc.theaimsgroup.com/?l=bugtraq&m=110988400407204</mlist> + </references> + <dates> + <discovery>2005-02-29</discovery> + <entry>2005-03-05</entry> + </dates> + </vuln> + <vuln vid="f3eec2b5-8cd8-11d9-8066-000a95bc6fae"> <topic>postnuke -- SQL injection vulnerabilities</topic> <affects> |