Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
2 selected

6 records

Vendor: Leif M. Wright Component: Web Blog Clear all filters
TI-2006-00823 CVE-2006-0845 · GHSA-fhj8-953f-fx7h

Leif M.

Priority LOW 31

Leif M. Wright's Blog 3.5 allows remote authenticated users with administrative privileges to execute arbitrary programs, including shell commands, by configuring the sendmail path to a malicious pathname.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01296 Published 2006-02-22 No fix listed
TI-2006-00822 CVE-2006-0844 · GHSA-6fgq-pch8-pq54

Leif M.

Priority LOW 36

Leif M. Wright's Blog 3.5 does not make a password comparison when authenticating an administrator via a cookie, which allows remote attackers to bypass login authentication, probably by setting the blogAdmin cookie.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01679 Published 2006-02-22 No fix listed
TI-2006-00821 CVE-2006-0843 · GHSA-p87g-jvpm-qw44

Leif M.

Priority LOW 26

Leif M. Wright's Blog 3.5 stores the config file and other txt files under the web root with insufficient access control, which allows remote attackers to read the administrator's password.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01425 Published 2006-02-22 No fix listed
TI-2004-02218 CVE-2004-2347 · GHSA-c488-mgpm-hg4c

blog.cgi in Leif M.

Priority MEDIUM 45

blog.cgi in Leif M. Wright Web Blog 1.1 and 1.1.5 allows remote attackers to execute arbitrary commands via shell metacharacters such as '|' in the file parameter of ViewFile requests.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.09874 Published 2005-08-16 No fix listed