CVE

Id
35303  
CVE No.
CVE-2008-5186  
Status
Candidate  
Description
** DISPUTED ** The set_language_path function in geshi.php in Generic Syntax Highlighter (GeSHi) before 1.0.8.1 might allow remote attackers to conduct file inclusion attacks via crafted inputs that influence the default language path ($path variable). NOTE: this issue has been disputed by a vendor, stating that only a static value is used, so this is not a vulnerability in GeSHi. Separate CVE identifiers would be created for web applications that integrate GeSHi in a way that allows control of the default language path.  
Phase
Assigned (20081120)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
386961 35303 CVE-2008-5186 MLIST:[oss-security] 20081110 GeSHi: Clarification about the recent security (non-)issues (SA32559)  View
386962 35303 CVE-2008-5186 URL:http://www.openwall.com/lists/oss-security/2008/11/10/8  View
386963 35303 CVE-2008-5186 CONFIRM:http://sourceforge.net/project/shownotes.php?release_id=637321  View
386964 35303 CVE-2008-5186 BID:32070  View
386965 35303 CVE-2008-5186 URL:http://www.securityfocus.com/bid/32070  View
386966 35303 CVE-2008-5186 OSVDB:49488  View
386967 35303 CVE-2008-5186 URL:http://osvdb.org/49488  View
386968 35303 CVE-2008-5186 SECUNIA:32559  View
386969 35303 CVE-2008-5186 URL:http://secunia.com/advisories/32559  View
386970 35303 CVE-2008-5186 XF:geshi-unspecified-code-execution(46271)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
48364 JVNDB-2008-003674 eSHOP100 の index.php における SQL インジェクションの脆弱性 eSHOP100 の index.php には、SQL インジェクションの脆弱性が存在します。 CVE-2008-5190 35303 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-003674.html  View