TI-2012-05459 CVE-2012-10036 · GHSA-hxc7-vv4w-87m3
Project Pier <= 0.8.8 Arbitrary File Upload RCE
Priority HIGH 81
Project Pier 0.8.8 and earlier contains an unauthenticated arbitrary file upload vulnerability in tools/upload_file.php.
Vulnerabilities
10 records
TI-2013-03179 CVE-2013-3637 · GHSA-f3cm-h3mx-xqvj
ProjectPier 0.8.8 does not use the Secure flag for cookies
Priority LOW 25
ProjectPier 0.8.8 does not use the Secure flag for cookies
TI-2013-03178 CVE-2013-3636 · GHSA-rhmv-3j65-6xmv
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
Priority LOW 26
ProjectPier 0.8.8 has a Remote Information Disclosure Weakness because of the lack of the HttpOnly cookie flag
TI-2013-03177 CVE-2013-3635 · GHSA-crhv-6685-98w3
ProjectPier 0.8.8 has stored XSS
Priority LOW 25
ProjectPier 0.8.8 has stored XSS
TI-2018-07612 CVE-2018-10760 · GHSA-42fp-75cg-7jf8
Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and…
Priority MEDIUM 40
Unrestricted file upload vulnerability in the Files plugin in ProjectPier 0.88 and earlier allows remote authenticated users to execute arbitrary PHP code by uploading a file with an executable extension, then accessing…
TI-2018-07611 CVE-2018-10759 · GHSA-j4xq-pqf9-r22p
PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8…
Priority MEDIUM 46
PHP remote file inclusion vulnerability in public/patch/patch.php in Project Pier 0.8.8 and earlier allows remote attackers to execute arbitrary commands or SQL statements via the id parameter.
TI-2015-02469 CVE-2015-2796 · GHSA-x996-8947-j879
Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core…
Priority LOW 29
Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the search_for parameter to (1) search_by_tag.php, (2) search_contact…
TI-2011-03354 CVE-2011-3797 · GHSA-cjq3-xc5m-c7fx
ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct…
Priority LOW 25
ProjectPier 0.8.0.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by public/upgrade/templates/layout…
TI-2008-05300 CVE-2008-5584 · GHSA-mv6v-6p7c-wgw6
Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow…
Priority LOW 25
Multiple cross-site scripting (XSS) vulnerabilities in ProjectPier 0.8 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) a message, (2) a milestone, or (3) a display name in a profile, or…
TI-2008-05299 CVE-2008-5583 · GHSA-cmh5-jc3p-3x8f
Cross-site request forgery (CSRF) vulnerability in index.php in ProjectPier 0.8 and…
Priority LOW 31
Cross-site request forgery (CSRF) vulnerability in index.php in ProjectPier 0.8 and earlier allows remote attackers to perform actions as an administrator via the query string, as demonstrated by a delete project action.