CVE-2008-0274

Cross-site scripting XSS vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files...

SA-2008-008 - Meta tags - Arbitrary code execution

The Meta tags module, also known as Nodewords, adds HTML META tags to node, panel and view pages. If the site is configured to allow images in the body of any node type, any user that can create this node type is able to execute arbitrary code on the server. Versions affected Meta tags for Drupal...

Docebo <= 3.5.0.3 (lib.regset.php/non-blind) SQL Injection Exploit

No description provided by source. ?php printr' ----------------------------------------------------------------------------- Docebo Suite = 3.5.0.3 lib.regset.php/non-blind SQL injection exploit by rgod bug found by EgiX working with Mysql = 4.1 PHP 5.X needed by Docebo regardless of php.ini...

Docebo <= 3.5.0.3 (lib.regset.php/non-blind) SQL Injection Exploit

Exploit for unknown platform in category web applications ================================================================== Docebo = 4.1 PHP 5.X needed by Docebo regardless of php.ini settings no benchmark quickly coded to perform credentials disclosure...

Docebo 3.5.0.3 - '/lib.regset.php/non-blind' SQL Injection

= 4.1 PHP 5.X needed by Docebo regardless of php.ini settings no benchmark quickly coded to perform credentials disclosure ----------------------------------------------------------------------------- '; if $argc 126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa....

SA-2008-002 - Atom - Access bypass

The Atom module provides a list of node titles, and teasers or bodies as part of a syndication feed. In certain conditions, the titles, teasers, and body were not respecting access permissions, potentially exposing content to syndication not available otherwise. Versions affected Atom for Drupal...

SA-2008-006 - Drupal core - Cross site scripting (UTF8)

When outputting plaintext Drupal strips potentially dangerous HTML tags and attributes from HTML, and escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input. Certain byte sequences that are invalid in the...

SA-2008-007 - Drupal core - Cross site scripting (register_globals)

When theme .tpl.php files are accessible via the web and the PHP setting registerglobals is set to enabled, anonymous users are able to execute cross site scripting attacks via specially crafted links. Drupals .htaccess attempts to set registerglobals to disabled and also prevents access to...

SA-2008-003 - BUEditor - CSRF

BUEditor is a plain textarea editor aiming to facilitate code writing. It supports completely customizable interface and button functionality via role-based editors. The Drupal Forms API protects against cross site request forgeries CSRF, where a malicous site can cause a user to unintentionally...

SA-2008-001 - Devel - Cross site scripting

The devel module contains many useful developer functions, such as a query log and the display of variables. The contents of the variable table is not escaped prior to display. Should an unprivileged user be able to control the contents of a site variable, it would be possible to inject arbitrary...

Novell Groupwise Windows客户端API非授权邮件访问漏洞

BUGTRAQ ID: 18716 CVECAN ID: CVE-2006-3268 Novell GroupWise是一款跨平台协作软件。 Novell GroupWise的客户端API实现上存在漏洞，攻击者可能利用漏洞绕过安全限制，访问某些非授权的邮件。 Novell Groupwise 7.x Novell Groupwise 6.x Novell Groupwise 5.x 厂商补丁： Novell ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： GroupWise 6.5: Apply SP6 Client Update 1...

CVE-2007-6320

Feature 4.7.x-dev and 5.x-dev before 20071206, a Drupal module, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery CSRF attacks...

CVE-2007-6320

The provided records identify CVE-2007-6320 as a vulnerability in a Drupal module (Feature 4.7.x-dev and 5.x-dev prior to 20071206). The root cause is that the module does not follow Drupal’s Forms API submission model, enabling remote attackers to perform cross-site request forgery (CSRF) attack...

CVE-2007-6303

MySQL 5.0.x before 5.0.51a, 5.1.x before 5.1.23, and 6.0.x before 6.0.4 does not update the DEFINER value of a view when the view is altered, which allows remote authenticated users to gain privileges via a sequence of statements including a CREATE SQL SECURITY DEFINER VIEW statement and an ALTER...

CVE-2007-6298

Cross-site scripting XSS vulnerability in the Shoutbox module for Drupal 5.x before Shoutbox 5.x-1.1 allows remote authenticated users to inject arbitrary web script or HTML via Shoutbox block messages...

CVE-2007-6298

Cross-site scripting XSS vulnerability in the Shoutbox module for Drupal 5.x before Shoutbox 5.x-1.1 allows remote authenticated users to inject arbitrary web script or HTML via Shoutbox block messages...

SA-2007-032 - Shoutbox - Cross site scripting

Message sent from the Shoutbox block, where visitors can quickly post short messages, are not properly sanitized in a number of cases. This allows malicious users to inject arbitrary HTML and script code into the block. Learn more about cross site scripting on Wikipedia. Versions affected Shoutbo...

Immunity Canvas: CVE_2007_4513

Name| CVE20074513 ---|--- CVE| CVE-2007-4513 Exploit Pack| CANVAS Description| CVE-2007-4513: lquerypv Notes| CVE Name: CVE-2007-4513 VENDOR: IBM VersionsAffected: 5.X Repeatability: unlimited CVE URL: https://vulners.com/cve/CVE-2007-4513 CVSS: 7.2...

Simple Machines Forum Search.php SQL Injection

The remote host is running Simple Machines Forum SMF, an open source web forum application written in PHP. The version of Simple Machines Forum installed on the remote host fails to sanitize user input to the 'userspec' parameter used in conjunction with the 'search2' action to the 'index.php'...

PHP 5.x COM - Safe Mode Disable Functions Bypass

PHP 5.x COM - Safe Mode Disable Functions Bypass sounds good //The windows version of PHP has built in support for this extension. You do not need to //load any additional extension in order to use these functions. //You are responsible for installing support for the various COM objects that you...