SA-CONTRIB-2013-019 - Ubercart Views - Cross site scripting (XSS)

Ubercart Views provides Views integration for the Ubercart shopping cart module. The "full name" field in Views is not properly sanitized on output. The vulnerability is mitigated by the fact that an attacker must get far enough in the checkout process to store their name with an order. CVE...

SA-CONTRIB-2013-017 - Yandex.Metrics - Cross site scripting (XSS)

The Yandex.Metrics module enables you to install Yandex.Metrica tracking code and watch reports by key indicators of user activity. The module doesn't sufficiently escape Yandex.Metrica service data when being displayed. This vulnerability is mitigated by the fact that it only impacts sites with...

Drupal 6.x < 6.28 / 7.x < 7.19 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 6.x prior to 6.28 or 7.x prior to 7.19. It is, therefore, potentially affected by multiple vulnerabilities : - A cross-site scripting XSS vulnerability exists due to properly sanitized user-supplied input to certain Drupal JavaScript...

Nagios3 - 'history.cgi' Host Command Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class Metasploit3 'Nagios3 history.cgi Hos...

Drupal Core 'getimagesize()'信息泄露漏洞

Drupal是一款开放源码的内容管理系统CMS Drupal 'getimagesize'函数存在安全漏洞，当上传的图像大小为空时，脚本不能读取图像内容，会显示一些错误信息，攻击者可以利用这些信息对系统进行进一步攻击 0 Drupal 6.x 7.18 厂商解决方案 目前没有详细解决方案提供： http://www.drupal.org/...

CVE-2012-5652

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a 1 RSS feed or 2 search result...

Design/Logic Flaw

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a 1 RSS feed or 2 search result...

CVE-2012-5652

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a 1 RSS feed or 2 search result...

CVE-2012-5651

Removed by vendor...

SA-CONTRIB-2012-174 - Context - Information Disclosure

Context has functionality that renders block content for use with its inline editor. When these requests are made the context module does not sufficiently ensure that users have access to the block. A malicious user could send a specially crafted request and get access to block content they shoul...

Apache Tomcat Multiple Critical Vulnerabilities

Some critical vulnerabilities have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS Denial of Service attack. These vulnerabilities affect Apache Tomcat 6.x and Apache Tomcat 7.x . Apache Tomcat vulnerabilities...

Apache Tomcat Multiple Critical Vulnerabilities

Some critical vulnerabilities have been reported in Apache Tomcat, which can be exploited by malicious people to bypass certain security restrictions and cause a DoS Denial of Service attack. These vulnerabilities affect Apache Tomcat 6.x and Apache Tomcat 7.x . Apache Tomcat vulnerabilities...

CVE-2012-4476

Cross-site scripting XSS vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

SA-CONTRIB-2012-169 - Email Field - Cross Site Scripting and Access bypass

The email module provides a field type CCK / FieldAPI for storing email addresses and a formatter to output the email address as a link to a contact form. The contact form formatter allows a site visitor to email the stored address without letting them see what that e-mail address is. Access bypa...

EmpireCMS 6. x explosive path vulnerability-vulnerability warning-the black bar safety net

Boring passing through a human body art site discovered by accident at the time scored with phpmyadmin unfortunately did not get phpmyadmin to the path...no way to export the Shell. desperation search EmpireCMS 6. x vulnerability also didn't search to the What back own when a set of the official...

CVE-2012-5886

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to...

SA-CONTRIB-2012-165 - Chaos tool suite (ctools) - Cross Site Scripting (XSS)

The Chaos tool suite is primarily a set of APIs and tools to improve the developer experience. The page manager node view task does not sufficiently escape node titles when setting the page title, allowing XSS. This vulnerability is partially mitigate by the node task being disabled by default an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 user name or 2 email address...

SA-CONTRIB-2012-159 - Password policy - Information leakage of hashed passwords

This module provides a way to specify a certain level of password complexity aka. "password hardening" for user passwords on a system by defining a password policy. The Password policy module allows administrators to request users to enter a new password that does not match any of the previous X...

Drupal Password Policy模块跨站请求伪造和跨站脚本执行漏洞

BUGTRAQ ID: 51385 CVE ID: CVE-2012-1633 Drupal是一款开源CMS，可以作为各种网站的内容管理平台。 Drupal Password Policy模块6.x-1.x 存在跨站脚本漏洞。可允许远程攻击者劫持管理员用户接通用户请求的验证。 0 Drupal Password Policy 6.X-1.X 厂商补丁： Drupal ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://drupal.org/...