84 matches found
CVE-2013-4498
The CVE-2013-4498 vulnerability affects the Drupal Spaces module (Spaces OG submodule, 6.x-3.x) prior to 6.x-3.7. Root cause: when moving content to a new group, Spaces OG fails to delete Organic Group group spaces content, leaving it orphaned. Impact: remote authenticated users with the "access ...
SA-CONTRIB-2013-081 - Spaces - Access bypass
This module enables you to make configuration options generally available only at the sitewide level to be configurable and overridden by individual "spaces" on a Drupal site. The spaces submodule, Spaces OG, doesn't properly handle deleting of organic group group spaces when the option to move t...
CVE-2012-4498
The Activism module 6.x-2.x before 6.x-2.1 for Drupal does not properly restrict access to the "Campaign" content type, which might allow remote attackers to bypass access restrictions and possibly have other unspecified impact...
CVE-2012-4498
The CVE-2012-4498 issue affects Drupal's Activism module (6.x-2.x) prior to 6.x-2.1. The root cause is improper access control that fails to restrict the Campaign content type, potentially allowing remote attackers to bypass access restrictions and cause other unspecified impact. Remediation per ...
Zabbix Server Arbitrary Command Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Zabbix Server Arbitrary Command...
Zabbix Server - Arbitrary Command Execution (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Zabbix Server Arbitrary Command...
CVE-2011-4498
Cross-site request forgery CSRF vulnerability in the web console in Zenprise Device Manager 6.x through 6.1.8 allows remote attackers to hijack the authentication of administrators for requests that wipe mobile devices...
CVE-2011-4498
Zenprise Device Manager 6.x–6.1.8 is affected by a CSRF vulnerability in the web console that lets an attacker hijack administrator authentication to trigger device wipe actions. The CVSS-based data from NVD indicates a network-accessible, low-complexity, no-auth attack with partial confidentiali...
CVE-2010-4498
The CVE-2010-4498 entry concerns a vulnerability in the TIBCO Collaborative Information Manager (CIM) server and ActiveCatalog prior to versions 8.1.0 and 1.0.1, respectively. The issue is described as an unspecified vulnerability that allows remote attackers to modify data or obtain sensitive in...
Code injection
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-4498. Reason: This candidate is a duplicate of CVE-2009-4498. Notes: All CVE users should reference CVE-2009-4498 instead of this candidate. All references and descriptions in this candidate have been removed to prevent...
Zabbix node_process_command() Function Crafted Request Arbitrary Command Execution
The version of Zabbix server running on the remote host has a command execution vulnerability in the 'processnodecommand' function of 'nodehistory.c'. A remote attacker could exploit this by sending a specially crafted request, resulting in the execution of operating system commands. C Tenable...
CVE-2009-4498
CVE-2009-4498 affects Zabbix Server before 1.8. The vulnerability lies in node_process_command() (nodehistory.c), allowing remote command execution via a crafted request. Documented impact is remote arbitrary command execution with network access (CVSSv2 base 6.8). Connected sources confirm explo...
CVE-2008-4498
SQL injection vulnerability in searchresults.php in PHP Autos 2.9.1 allows remote attackers to execute arbitrary SQL commands via the catid parameter...
CVE-2008-4498
The CVE-2008-4498 entry describes an SQL injection vulnerability in PHP Autos 2.9.1, exploitable via the catid parameter in searchresults.php. It allows remote attackers to execute arbitrary SQL commands. According to the NVD data, the flaw is network-accessible (CVSSv2: AV:N/AC:L/Au:N/C:P/I:P/A:...
CVE-2008-4498
creationtimestamp| type| source ---|---|--- 2008-10-07 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/6696...
CVE-2006-4498
PHP remote file inclusion vulnerability in sommaireadmin.php in PhpAlbum modphpalbum 2.15 for PortailPHP allows remote attackers to execute arbitrary PHP code via a URL in the chemin parameter, a different vector than CVE-2006-3922...
CVE-2006-4498
CVE-2006-4498 describes a PHP remote file inclusion in sommaire_admin.php of PhpAlbum (mod_phpalbum) 2.15 for PortailPHP. The vulnerability allows remote attackers to execute arbitrary PHP code by supplying a URL in the chemin parameter, a different vector from CVE-2006-3922. The linked NVD entry...
CVE-2005-4498
Text-e 1.6.4 and earlier contains a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified search parameters. The existing records do not specify the exact vulnerable component beyond the search parameter vector, nor do they pr...
