CVE

Id
21833  
CVE No.
CVE-2006-5729  
Status
Candidate  
Description
Yazd Discussion Forum before 3.0 beta does not properly manage forum permissions, which allows remote authenticated users to (1) reply to a message in an arbitrary forum, if authorized to create a message in any forum; and (2) perform certain unauthorized forum actions, related to an "error in how the permissions were assembled" that assigns extra permissions to users.  
Phase
Assigned (20061106)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
209030 21833 CVE-2006-5729 CONFIRM:http://sourceforge.net/project/shownotes.php?group_id=39239&release_id=460547  View
209031 21833 CVE-2006-5729 BID:20889  View
209032 21833 CVE-2006-5729 URL:http://www.securityfocus.com/bid/20889  View
209033 21833 CVE-2006-5729 SECUNIA:22690  View
209034 21833 CVE-2006-5729 URL:http://secunia.com/advisories/22690  View
209035 21833 CVE-2006-5729 XF:yazd-unspecified-security-bypass(29994)  View
209036 21833 CVE-2006-5729 URL:http://xforce.iss.net/xforce/xfdb/29994  View
209037 21833 CVE-2006-5729 XF:yazd-messages-security-bypass(29996)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
60105 JVNDB-2006-002371 Lithium CMS の classes/index.php におけるディレクトリトラバーサルの脆弱性 Lithium CMS の classes/index.php は、db/comments/news/ の配下に格納される、および classes/index.php によってインクルードされるため、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2006-5731 21833 6.4 http://jvndb.jvn.jp/ja/contents/2006/JVNDB-2006-002371.html  View