fgeek / pyfiscan Goto Github PK

Current fingerprint detects false-posivites with Git-version of Gallery3.

Mailer should send emails with header Date. Thanks for reporting Tuukka Kivilahti.

https://www.netsparker.com/critical-xss-vulnerabilities-in-claronline/

Is this fixed?

At least Drupal 5 and 6 are still supported before 8 is released.

Mailer should send only one email per receiver. Requested by Henri Strand.

Currently there is no fixed in version for latest issues. Makes it pretty hard to communicate with end users.

CVE-2013-4879
CVE-2013-4880
CVE-2013-4881
CVE-2013-5313

Change code so that one application can have multiple issues in fingerprint. This can be used for e.g. affected version ranges in the future.

http://forelsec.blogspot.fi/2013/10/dolibarr-340-multiple-vulnerabilities.html

Does these have CVE? Listed in OSVDB?

No official fix for this?

• phpBB3 makes backups in update to location includes/install/update/old
• Joomla creates temporary files in update to location tmp/install_4ee88b2db4c46
• concrete5: files/tmp/1323955337/concrete5.4.2.1

• Figure out proper content
• Add examples
• Change previous fingerprints to new template

Template should include following:

• CWE
• CVSS2
• CVE
• OSVDB
• Secunia (SAXXXX)
• Publication date
• Fixed date
• Fixed in version
• CPE
• ISS X-Force ID
• SecurityTracker Alert ID
• Vendor URL
• Vendor changelog or scm urls

Jara has several unfixed vulnerabilities for many years now. Detection should say not to use this software.

Attacker can install the WordPress using remote database and after that execute arbitrary PHP.

This requires new post processing functionality.

References:

• CVE-2012-0937
• http://osvdb.org/78710

2013-08-24 21:49:57 ERROR is_not_secure:166 Traceback (most recent call last):
File "pyfiscan.py", line 164, in is_not_secure
return map(int, secure_version.split('.')) > map(int, file_version.split('.'))
ValueError: invalid literal for int() with base 10: ''

From file:
# CPG MiniCMS Plugin for Coppermine Photo Gallery

http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2014-001/

https://en.wikipedia.org/wiki/Mura_CMS

Add support for CVE-2013-3929.

Need support to fetch version number from SQL-database. Probably also affects Joomla 3.x versions.

http://www.mondounix.com/category/wordpress/wordpress_security/
http://codevigilant.com/disclosures/

http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-November/000135.html

Could be implemented using http://docs.python.org/library/atexit.html with knowledge of current working directory and queues. Tuomo Komulainen requested this.

Investigate if Gallery 2 is still supported and update gallery.yml accordingly.

SMTPAuthenticationError: (535, 'Incorrect authentication data')

If installation is upgraded from Joomla 1.6.1 to 1.7.x by unzipping there will be both version files libraries/joomla/version.php and includes/version.php where first is the old one.

• Check if this also affects web-ui updates
• Test from 1.6.x to 1.7.x
• Test from 1.7.x to 2.x
• Test from 2.x to 3.x