RSS   Vulnerabilities for 'Projectpier'   RSS

2018-05-16
 
CVE-2018-10760

CWE-434
 

 
Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing it via a direct request to the file in the tmp directory under the document root.

 
2011-09-23
 
CVE-2011-3797

CWE-200
 

 
ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout.php and certain other files.

 
2008-12-15
 
CVE-2008-5584

CWE-79
 

 
Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a message, (2) a milestone, or (3) a display name in a profile, or the (4) a or (5) c parameter to index.php.

 
 
CVE-2008-5583

CWE-352
 

 
Cross-site request forgery (CSRF) vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via the query string, as demonstrated by a delete project action.

 

 >>> Vendor: Projectpier 2 Products
Projectpier
Project pier


Copyright 2024, cxsecurity.com

 

Back to Top