SA-CONTRIB-2009-060 - Meta tags (Nodewords) - Access bypass

The Meta tags also known as Nodewords module provides meta tags based on node titles. In certain conditions, the node meta tags were not respecting access permissions, potentially exposing content not available otherwise. Versions affected Meta tags for Drupal 6.x before Meta tags 6.x-1.1 Drupal...

Fedora 11 : drupal-date-6.x.2.4-0.fc11 (2009-9736)

Advisory ID: DRUPAL-SA-CONTRIB-2009-057 http://drupal.org/node/579144 - Project: Date third-party module Version: 5.x, 6.x Date: 2009-September-16 Security risk: Moderately critical Exploitable from: Remote Vulnerability: Cross Site Scripting -------- DESCRIPTION...

Fedora 11 : drupal-6.14-1.fc11 (2009-9721)

Fixes SA-CORE-2009-008 http://drupal.org/node/579482 Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script. Multiple vulnerabilities and weaknesses were discovered in Drupal...

SA-CONTRIB-2009-057 - Date - Cross Site Scripting

The Date module provides a date CCK field that can be added to any content type. The Date module does not properly escape user data correctly in some cases when setting the page title. A malicious user with permission to post date content could attempt a cross site scripting XSS attack when...

CVE-2009-3160

CVE-2009-3160 affects IBM WebSphere MQ 6.x up to 6.0.2.7 and 7.0.x (7.0.0.0, 7.0.0.1, 7.0.0.2, 7.0.1.0). The issue is related to a memory overwrite vulnerability when read-ahead or asynchronous message consumption is enabled. The provided documents describe an unspecified impact and unknown vecto...

Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09

This host has Internet Explorer installed and is prone to Denial of Service vulnerability. OpenVAS Vulnerability Test $Id: gbmsielielementdosvulnsep09.nasl 7293 2017-09-27 08:49:48Z cfischer $ Microsoft Internet Explorer 'li' Element DoS Vulnerability - Sep09 Authors: Sharath S Copyright: Copyrig...

SA-CONTRIB-2009-052 - Printer, e-mail and PDF versions - Cross site scripting

The Printer, e-mail and PDF versions "Print" module provides printer-friendly versions of content. The module doesn't properly escape a number of user-supplied variables before output. A user who has the permission to add content could attempt a cross site scripting XSS attack which may in some...

SA-CONTRIB-2009-051 - ImageCache - Multiple vulnerabilities

ImageCache allows one to setup presets for image processing to create derivatives. ImageCache will dynamically generate a derivative on access if it doesn't exist. Cross site scripting Users with the "administer imagecache" permission are able to execute cross site scripting attacks because the...

SA-CONTRIB-2009-050 - Webform report - Cross site scripting

Webform report allows users to create simple, dynamic reports based on data collected by the webform module. When displaying the results of Webform submissions, the module does not properly escape user entered data, leading to a cross-site scripting XSS vulnerability. Versions affected Webform...

Fedora 11 : drupal-date-6.x.2.3-0.fc11 (2009-8184)

Advisory ID: DRUPAL-SA-CONTRIB-2009-046 Project: Date third-party module Version: 6.x Date: 2009-July-29 Security risk: Moderately critical Exploitable from: Remote Vulnerability: Cross Site Scripting -------- DESCRIPTION -------------------------------------------------------- - The Date module...

Fedora 10 : drupal-date-6.x.2.3-0.fc10 (2009-8162)

Advisory ID: DRUPAL-SA-CONTRIB-2009-046 Project: Date third-party module Version: 6.x Date: 2009-July-29 Security risk: Moderately critical Exploitable from: Remote Vulnerability: Cross Site Scripting -------- DESCRIPTION -------------------------------------------------------- - The Date module...

SA-CONTRIB-2009-047 - Calendar - Cross Site Scripting

The Calendar module enables Views module to display any Date module date field as a calendar. The module does not properly escape user input when displaying titles of content types that have Date fields. A user with permission to create new content types including via the Date module's Date Tools...

SA-CONTRIB-2009-049 - Live - Privilege escalation, Impersonation

The Live module provides dynamic previews of content. When editing certain content nodes, the current user becomes logged in as the content's original author. Versions affected Live for Drupal 6.x prior to 6.x-1.2 Drupal core is not affected. If you do not use the contributed Live module, there i...

SA-CONTRIB-2009-046 - Date - Cross Site Scripting

The Date module provides a date CCK field that can be added to any content type. The Date Tools module that is bundled with Date module does not properly escape user input when displaying labels for fields on a content type. A malicious user with the 'use date tools' permission of the Date Tools...

SA-CONTRIB-2009-044 - Bubbletimer - Multiple vulnerabilities

Bubbletimer allows users to create timesheets based on nodes. It suffers from a cross-site scripting XSS vulnerability due to not properly sanitizing node titles before they are displayed. It is also vulnerable to cross-site request forgeries CSRF making it possible for users to unknowingly add...

Drupal XSS and Code Injection Vulnerability

Drupal is prone to Cross Site Scripting and Remote Code Injection vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

FreeBSD : drupal -- multiple vulnerabilities (be927298-6f97-11de-b444-001372fd0af2)

The Drupal Security Team reports : Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages...

CVE-2009-2373

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2372

Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user...

Cross site scripting

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...