Vulnerabilities > Gforge

DATE CVE VULNERABILITY TITLE RISK
2019-03-25 CVE-2019-10016 Cross-Site Scripting vulnerability in Gforge Advanced Server 6.4.4
GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter, as demonstrated by a snippet/search/?words= substring.
network
gforge CWE-79
4.3
2009-12-04 CVE-2009-3304 Link Following vulnerability in Gforge 4.5.14/4.7/4.8.2
GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite arbitrary files via a symlink attack on authorized_keys files in users' home directories, related to deb-specific/ssh_dump_update.pl and cronjobs/cvs-cron/ssh_create.php.
local
gforge CWE-59
3.3
2009-11-24 CVE-2009-4070 SQL Injection vulnerability in Gforge 4.5.14/4.7.3
SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly other versions allows remote attackers to execute arbitrary SQL commands via unknown vectors.
network
low complexity
gforge CWE-89
7.5
2009-11-24 CVE-2009-4069 Cross-Site Scripting vulnerability in Gforge 4.5.14/4.7.3
Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5.14, 4.7.3, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
network
gforge CWE-79
4.3
2009-11-24 CVE-2009-3303 Cross-Site Scripting vulnerability in Gforge 4.5.14/4.7/4.8.1
Cross-site scripting (XSS) vulnerability in www/help/tracker.php in GForge 4.5.14, 4.7 rc2, and 4.8.1 allows remote attackers to inject arbitrary web script or HTML via the helpname parameter.
network
gforge CWE-79
4.3
2009-02-19 CVE-2008-6189 SQL Injection vulnerability in Gforge 4.5.19
SQL injection vulnerability in GForge 4.5.19 allows remote attackers to execute arbitrary SQL commands via the offset parameter to (1) new/index.php, (2) news/index.php, and (3) top/topusers.php, which is not properly handled in database-pgsql.php.
network
low complexity
gforge CWE-89
7.5
2009-02-19 CVE-2008-6188 SQL Injection vulnerability in Gforge
SQL injection vulnerability in people/editprofile.php in Gforge 4.6 rc1 and earlier allows remote attackers to execute arbitrary SQL commands via the skill_edit[] parameter.
network
low complexity
gforge CWE-89
7.5
2009-02-19 CVE-2008-6187 SQL Injection vulnerability in Gforge
SQL injection vulnerability in frs/shownotes.php in Gforge 4.5.19 and earlier allows remote attackers to execute arbitrary SQL commands via the release_id parameter.
network
low complexity
gforge CWE-89
7.5
2009-01-02 CVE-2008-2381 SQL Injection vulnerability in Gforge 4.5/4.6
SQL injection vulnerability in the create function in common/include/GroupJoinRequest.class in GForge 4.5 and 4.6 allows remote attackers to execute arbitrary SQL commands via the comments variable.
network
low complexity
gforge CWE-89
7.5
2008-05-18 CVE-2008-0167 Link Following vulnerability in Gforge 4.5.14
The write_array_file function in utils/include.pl in GForge 4.5.14 updates configuration files by truncating them to zero length and then writing new data, which might allow attackers to bypass intended access restrictions or have unspecified other impact in opportunistic circumstances.
local
low complexity
debian gforge CWE-59
4.6