GCVE - cpe:2.3:a:flyspray:flyspray:0.9.9:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:flyspray:flyspray:0.9.9:*:*:*:*:*:*:*

part: a version: 0.9.9 update: *

Vendor	Flyspray (`c44ec6fa-32cf-583f-832c-6daf94b4de8f`)
Product	Flyspray (`caf52a7e-4bc5-5f55-a66a-552e6b9c5bf7`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/flyspray/flyspray`	purl2cpe	2026-06-01 10:16:13.330602
`pkg:sourceforge/flyspray`	purl2cpe	2026-06-01 10:16:13.330604

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2008-1166`	vulnerable	2026-06-08 04:50:19.422169	Details available Flyspray 0.9.9.4 generates different error messages depending on whether the username is valid or invalid, which allows remote attackers to enumerate usernames. Published: 2008-03-05T23:00:00.000Z Updated: 2024-08-07T08:08:57.710Z Open on db.gcve.eu Reference links http://secunia.com/advisories/29215 https://exchange.xforce.ibmcloud.com/vulnerabilities/40964 http://www.securityfocus.com/archive/1/489020/100/0/threaded	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-1165`	vulnerable	2026-06-08 04:50:19.419482	Details available Multiple cross-site scripting (XSS) vulnerabilities in Flyspray 0.9.9 through 0.9.9.4 allow remote attackers to inject arbitrary web script or HTML via (1) a forced SQL error message or (2) old_value and new_value database fields in task summaries, related to the item_summary parameter in a details action in index.php. NOTE: some of these details are obtained from third party information. Published: 2008-03-05T23:00:00.000Z Updated: 2024-08-07T08:08:57.677Z Open on db.gcve.eu Reference links http://flyspray.org/fsa:3 http://secunia.com/advisories/29215 https://exchange.xforce.ibmcloud.com/vulnerabilities/40963	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-6461`	vulnerable	2026-06-08 04:50:08.869115	Details available Multiple cross-site scripting (XSS) vulnerabilities in index.php in Flyspray 0.9.9 through 0.9.9.3 allow remote attackers to inject arbitrary web script or HTML via (1) the query string in an index action, related to the savesearch JavaScript function; and (2) the details parameter in a details action, related to the History tab and the getHistory JavaScript function. Published: 2007-12-20T00:00:00.000Z Updated: 2024-08-07T16:11:05.637Z Open on db.gcve.eu Reference links http://secunia.com/advisories/28106 http://osvdb.org/39256 http://flyspray.org/fsa:2 http://osvdb.org/39257	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-1789`	vulnerable	2026-06-08 04:49:43.455493	Details available Flyspray 0.9.9 allows remote attackers to obtain sensitive information (private project summaries) via direct requests. Published: 2007-03-31T10:00:00.000Z Updated: 2024-08-07T13:06:26.349Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/23214 http://osvdb.org/34591 http://secunia.com/advisories/24702 http://www.flyspray.org/changelog http://www.vupen.com/english/advisories/2007/1181	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-1788`	vulnerable	2026-06-08 04:49:43.455087	Details available Flyspray 0.9.9, when output_buffering is disabled or "set to a low value," allows remote attackers to bypass authentication via a crafted post request. Published: 2007-03-31T10:00:00.000Z Updated: 2024-08-07T13:06:26.393Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/23214 http://secunia.com/advisories/24702 http://www.flyspray.org/fsa:1 http://www.vupen.com/english/advisories/2007/1181	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Flyspray

Notes

PURL mappings

Vulnerability references

Contribute