SA-CONTRIB-2012-003 - Fill PDF - Multiple vulnerabilities

CVE: CVE-2012-1625 This module enables you to populate fillable PDF templates with data from nodes and webforms. Access bypass 7.x only Incorrectly-ordered arguments in a call to the function that handles the main functionality of the module makes it possible for an attacker to trigger any PDF to...

SA-CONTRIB-2011-058 - Support Timer - Cross Site Scripting (XSS)

The Support Timer module adds a javascript-based timer to the Support Ticketing System for tracking how long users are working on support tickets, as well as administrative reports. The module does not properly sanitize user-supplied content, resulting in multiple Cross-Site Scripting XSS...

SA-CONTRIB-2011-056 - Webform Validation Cross Site Scripting

The Webform Validation module enables you to add form validation rules to Webform components through a UI. The module contains multiple cross site scripting XSS vulnerabilities due to the fact that it fails to sanitize certain user entered text prior to displaying in the browser. This vulnerabili...

CVE-2011-4560

Cross-site scripting XSS vulnerability in the Petition Node module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to signing a petition...

IBM WebSphere MQ控件远程安全限制绕过漏洞

BUGTRAQ ID: 50693 IBM WebSphere MQ用于在企业中提供消息传输服务。 IBM WebSphere MQ没有限制对某些WebSphere MQ控件命令的访问，可通过 ENDMQCSV 控件命令在指定的队列管理器上停止命令服务器。要成功利用此漏洞需要在系统上设置MQM组默认权限。 IBM WebSphere MQ 6.x 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.ers.ibm.com/...

SA-CONTRIB-2011-051 - Hotblocks module - multiple vulnerabilities

The HotBlocks module provides a rich experience for managing blocks. The module contained multiple vulnerabilities including Cross Site Scripting XSS, Access Bypass, and Cross Site Request Forgery CSRF. XSS is mitigated by the fact that an attacker must have a role with the permission "administer...

SA-CONTRIB-2011-047 - OG Features access bypass

OG Features provides a mechanism for groups to enable or disable certain bundles of functionality, of features, within the groups they administer. The module is able to turn components on and off within given groups by overriding the access callbacks of every menu item, and checking conditions...

SA-CONTRIB-2011-043 - Petition Node - Cross Site Scripting

Petition node module allows the creation of petition nodes to collect signatures to show support for a cause. The module contains a cross site scripting XSS vulnerability that can be exploited when signing a petition. This vulnerability is mitigated by the fact that it normally requires the 'sign...

SA-CONTRIB-2011-042 Views Bulk Operations - Cross Site Scripting

The Views Bulk Operations VBO module allows actions and rules to be run on the selected views rows nodes, terms, user, etc. It also bundles several convenient actions. One of those actions allows the bulk modification of taxonomy terms on a node. When using the "Modify node taxonomy terms" action...

CVE-2011-3577

CVE-2011-3577 affects IBM WebSphere Commerce: versions 6.x up to 6.0.0.11 and 7.x up to 7.0.0.3 do not properly implement Activity Token authentication for Web Services. The underlying cause is an improper authentication mechanism, but the connected documents do not specify exact technical detail...

SA-CONTRIB-2011-039 - Bot Alarm - Multiple vulnerabilities

This module enables you to set alarms for your IRC bot. The module does not properly escape the message and channels of alarms in pages listing the alarms, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Apache Tomcat 6.0.x < 6.0.33 Multiple Vulnerabilities

Binary data 800602.prm...

SA-CONTRIB-2011-035 Forward module - Open redirect

The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module doesn't check to ensure that the page being forwarded refers to an internal path. This could allow someone to hard...

SA-CONTRIB-2011-032 - Mail Logger - Cross Site Scripting

The Mail Logger module logs all outgoing e-mails and provides users with the "access mail logger" permission to view logged e-mails. The module does not sanitize the log output of addressee information, subject, and body, leading to a Cross-Site Scripting XSS vulnerability that may lead to a...

科汛kesion 6.x - 7.06 /user/reg/regajax.asp SQL注射漏洞

科汛cms,eshop系统建站第一品牌.专业提供开源cms项目定制服务及名片系统，在线输出，在线印刷，广告制作，在线图文下单系统提供商。 /user/reg/regajax.asp 在数据处理上存在安全问题 科汛kesion 6.x - 7.06 官方已经发布补丁 http://www.kesion.com/...

HTC HD2 Mobile Phone - Lock Screen Keyboard Bypass

Document Title: =============== HTC HD2 Mobile Phone - Lock Screen Keyboard Bypass Release Date: ============= 2011-07-19 Vulnerability Laboratory ID VL-ID: ==================================== 185 Product & Service Introduction: =============================== Der HTC HD2 liefert Ihnen ein...

HTC HD2 Mobile Phone - Lock Screen Keyboard Bypass

Document Title: =============== HTC HD2 Mobile Phone - Lock Screen Keyboard Bypass Release Date: ============= 2011-07-19 Vulnerability Laboratory ID VL-ID: ==================================== 185 Product & Service Introduction: =============================== Der HTC HD2 liefert Ihnen ein...

SA-CONTRIB-2011-026 - Secure Password Hashes (phpass) - Multiple Vulnerabilities

This module uses the PHPass hashing library to try to store users hashed passwords securely. The module sets a fixed string for the 'pass' column in the users database column but does not replace the pass attribute of the account object used for password reset links. This leads to a vulnerability...

SA-CONTRIB-2011-024 - Spam - Cross Site Request Forgery (CSFR)

The Spam module provides numerous tools to auto-detect and deal with spam content that is posted to your site, without having to rely on third-party services. The Spam module provides a trainable Bayesian filter, automatic learning of spammer URLs, flagging of content with an excessive number of...

SA-CONTRIB-2011-022 - Cosign - SQL Injection

Under certain conditions the module deletes uid 1 and then does an unparameterized dbquery to insert a new uid 1. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer site configuration" and must be able to remotely manipulate the web serve...