Format string

Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user...

CVE-2009-2373

Drupal 6.x: The Forum module is vulnerable to Cross-Site Scripting (XSS) via unspecified vectors, affected up to version 6.12/6.13 (per description: before 6.13). This allows remote attackers to inject arbitrary web script or HTML. Connected advisories confirm CVE-2009-2373 and reference Drupal f...

Fedora 9 : drupal-6.13-1.fc9 (2009-7362)

Fixes SA-CORE-2009-007 http://drupal.org/node/507572 . Remember to log in to your site as the admin user before upgrading this package. After upgrading the package, browse to http://host/drupal/update.php to run the upgrade script. Multiple vulnerabilities and weaknesses were discovered in Drupal...

SA-CONTRIB-2009-040 - Advanced Forum - Multiple vulnerabilities

Cross-site scripting The Advanced Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages. Such a cross-site scriptin...

SA-CORE-2009-007 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal. Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML an...

Design/Logic Flaw

Nodequeue 5.x before 5.x-2.7 and 6.x before 6.x-2.2, a module for Drupal, does not properly restrict access when displaying node titles, which has unknown impact and attack vectors...

CVE-2009-2077

Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and 1 read unpublished content from anonymous users when a view is already configured to display the content, and 2 read private content in generated queries...

Fedora 9 : drupal-views-6.x.2.6-1.fc9 (2009-6171)

Advisory ID: DRUPAL-SA-CONTRIB-2009-037 0 Project: Views Versions: 6.x-2.x Date: 2009-June-10 Security risk: Moderately critical Exploitable from: Remote Vulnerability: Cross Site Scripting XSS, Access Bypass -------- DESCRIPTION -------------------------------------------------------- - The...

PT-2009-4529 · Drupal · Drupal Views

Name of the Vulnerable Software and Affected Versions: Drupal Views module versions prior to 6.x-2.6 Description: A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via exposed filters in the Views UI administrative interface and the view nam...

SA-CONTRIB-2009-035 - Booktree - Cross site scripting

Booktree takes as input a series of Book nodes and create a tree-like structure using Book node relationships.The Booktree module does not properly escape node title and node body on tree root pages. A user with privileges to create book pages could attempt a cross site scripting XSS attack which...

Command injection

The ListView control in the Client GUI AClient.exe in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to 1 overwrite the CommandLine...

SA-CONTRIB-2009-032 - Webform - Cross-site scripting

The Webform module provides a node type which is typically used to enable site visitors to fill in questionnaires, contact or request/registration forms, surveys, polls, or other forms on a Drupal site. When displaying the results of Webform submissions, the module does not properly filter user...

CVE-2009-1844

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow 1 remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the...

CVE-2009-1844

CVE-2009-1844 affects Drupal 5.x (prior to 5.18) and 6.x (prior to 6.12). The issue comprises two XSS vectors: (1) remote authenticated users can inject script via UTF-8 byte sequences misinterpreted as UTF-7 in the HTML exports of books, and (2) remote authenticated users with administer taxonom...

CVE-2009-1738

Cross-site scripting XSS vulnerability in Feed Block 6.x-1.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with administrator feed permissions to inject arbitrary web script or HTML via unspecified vectors in "aggregator items."...

SA-CONTRIB-2009-028 - Feed Block - Cross Site Scripting

The Feed Block module creates a block with one externalsyndicated article for each feed source from selected feed category. Feed block doesn't properly escapes aggregator items allowing users with administer news feeds permission to inject arbitrary code into the site. Such a cross site scripting...

Cross site request forgery (csrf)

Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an...

CVE-2009-1576

Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an...

Fedora 10 : drupal-cck-6.x.2.2-1.fc10 (2009-2869)

Fixes DRUPAL-SA-CONTRIB-2009-013 - XSS issue: http://drupal.org/node/406520 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introduci...

Microsoft Word 2000 WordPerfect转换器栈溢出漏洞（MS09-010）

BUGTRAQ ID: 34469 CVECAN ID: CVE-2009-0088 Word是微软Office套件中的文件处理工具。 Word可以通过应用过滤器模块将其他应用程序所创建的文档转换为Word可使用的格式。Word 2000所使用的WordPerfect 6.x转换器的转换代码没有对数据结构所分配的长度正确的验证计数器，如果解析了特制的WordPerfect文档就可能触发栈溢出，导致执行任意代码。 Microsoft Word 2000 SP3 临时解决方法： 不要打开或保存从不可信任来源接收到的或从可信任来源意外接收到的Microsoft Office文件。...