[DRUPAL-SA-2007-018] Drupal 4.7.7 and 5.2 fix multiple cross site scripting vulnerabilities

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2007-018 ---------------------------------------------------------------------------- Project: Drupal core Version: 4.7.x, 5.x Date: 2007-July-26 Security risk: Moderately critical...

Print - Access bypass

Print is a module that allows site administrators to produce a "print friendly" version of a posting. By manipulating URL arguments, authenticated and anonymous users are able to access posts that should have been restricted by a node access module such as Organic Groups, Taxonomy Access Control,...

Apple ITunes 4.7 Playlist Buffer Overflow

This module exploits a stack buffer overflow in Apple ITunes 4.7 build 4.7.0.42. By creating a URL link to a malicious PLS file, a remote attacker could overflow a buffer and execute arbitrary code. When using this module, be sure to set the URIPATH with an extension of '.pls'. This module requir...

[DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue

---------------------------------------------------------------------------- Drupal security advisory DRUPAL-SA-2007-005 ---------------------------------------------------------------------------- Project: Drupal core Version: 4.7.x, 5.x Date: 2007-Jan-29 Security risk: Highy critical Exploitabl...

Drupal Acidfree模块节点标题SQL注入漏洞

WebSpell是一款基于PHP的WEB应用程序。 WebSpell不正确过滤用户提交的输入，远程攻击者可以利用漏洞进行SQL注入攻击，获得敏感信息。 问题是脚本对用户提交的Node标题参数缺少过滤，提交恶意SQL脚本代码作为参数数据，可更改原来的SQL逻辑，导致获得敏感信息。 Drupal Acidfree Module 4.7 Drupal Acidfree Module 4.6 厂商解决方案 升级程序： Drupal Acidfree Module 4.6 Drupal acidfree-4.6.x-1.0.tar.gz...

Project and Project issue tracking XSS

Several fields are not passed through checkplain on display. A malicious user could use these fields to insert and execute XSS Cross Site Scripting. This may lead to administrator access if certain conditions are met. Additionally, certain error messages are generated that include potentially...

CVS management/tracker XSS

The motivation field of the CVS application page is not passed through checkmarkup on display. A malicious user may use this field to insert and execute XSS Cross Site Scripting. This may lead to administrator access if certain conditions are met. Learn more about XSS on Wikipedia. Revoking the...

HP-UX PHSS_35436 : s700_800 11.04 Virtualvault 4.7 OWS (Apache 2.x) update

s700800 11.04 Virtualvault 4.7 OWS Apache 2.x update : The remote HP-UX host is affected by multiple vulnerabilities : - Potential security vulnerabilities have been identified with Apache running on HP-UX VirtualVault. These vulnerabilities could be exploited remotely to allow execution of...

HP-UX PHSS_35458 : s700_800 11.04 Virtualvault 4.5 IWS Update

s700800 11.04 Virtualvault 4.5 IWS Update : The remote HP-UX host is affected by multiple vulnerabilities : - A security vulnerability has been identified in OpenSSL used in HP VirtualVault 4.7, 4.6, 4.5 and HP WebProxy that may allow remote unauthorized access. HPSBUX02165 SSRT061266 - Two...

HP-UX PHSS_35460 : s700_800 11.04 Virtualvault 4.7 IWS update

s700800 11.04 Virtualvault 4.7 IWS update : The remote HP-UX host is affected by multiple vulnerabilities : - Two potential security vulnerabilities have been reported in HP-UX VirtualVault Apache HTTP server versions prior to Apache 1.3.37 that may allow a Denial of Service DoS attack and...

Firebird 1.0.2 FreeBSD 4.7-RELEASE Local Root Exploit

No description provided by source. / DSR-firebird.c ------------------------------- Tested on: Firebird 1.0.2 FreeBSD 4.7-RELEASE This is Proof Of concept code. bash-2.05a$ ./DSR-firebird Firebird-1.0.2 Local exploit for Freebsd 4.7 by - [email protected]...

CVE-2006-5475

Multiple cross-site scripting XSS vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed...

CVE-2006-5476

Drupal CSRF vulnerability CVE-2006-5476 affects Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4, allowing remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors. Root cause: CSRF in the core functionality. Impact: unauthorized actions as another user. Reme...

CVE-2006-4947

Cross-site scripting XSS vulnerability in the Drupal 4.7 Search Keywords module before 1.15 2006/09/15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "lack of validation on output."...

CVE-2006-4949

Cross-site scripting XSS vulnerability in the Drupal 4.6 Site Profile Directory profilepages.module before 1.1.2.1 and the Drupal 4.7 Site Profile Directory profilepages.module before 1.2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "lack o...

CVE-2006-4947

Cross-site scripting XSS vulnerability in the Drupal 4.7 Search Keywords module before 1.15 2006/09/15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "lack of validation on output."...

CVE-2006-4821

Cross-site scripting XSS vulnerability in the Drupal 4.7 Userreview module before 1.19 2006/09/12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2006-4821

CVE-2006-4821 is a cross-site scripting (XSS) flaw in the Drupal 4.7 Userreview module prior to version 1.19 (2006-09-12). The vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The NVD metrics assign a CVSS v2 base score of 4.3 (Medium); attack ...

PhotoPost 4.6 - PP_PATH Remote File Inclusion

PhotoPost 4.6 - PPPATH Remote File Inclusion ==================================================================== PhotoPost = 4.6 PPPATH Remote File Inclusion Exploit ==================================================================== Critical Level : Dangerous By Saudi Hackrz...

Userreview cross site scripting vulnerability

It is possible for a malicious user to insert and execute XSS Cross Site Scripting, due to lack of validation on output. This may lead to administrator access if certain conditions are met. Learn more about XSS on Wikipedia. Versions affected Drupal core is not affected. If you do not use the...