1092 matches found
CVE-2009-0088
The WordPerfect 6.x Converter WPFT632.CNV, 1998.1.27.0 in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string, which allows remote attackers to execute arbitrary code via a crafted WordPerfect 6.x file, related to an...
CVE-2009-0088
The WordPerfect 6.x Converter WPFT632.CNV, 1998.1.27.0 in Microsoft Office Word 2000 SP3 and Microsoft Office Converter Pack does not properly validate the length of an unspecified string, which allows remote attackers to execute arbitrary code via a crafted WordPerfect 6.x file, related to an...
SA-CONTRIB-2009-020 - Print - Cross site scripting
The Printer, e-mail and PDF versions "Print" module provides printer-friendly versions of content. The module does not correctly escape content titles, enabling malicious users to insert arbitrary HTML and scripts into certain pages. Such a cross site scripting XSS attack against sufficiently...
SA-CONTRIB-2009-021 CCK comment reference - Cross site scripting
CCK comment reference project, lets administrators define node fields that are references to comments. When displaying a node edit form, the titles of candidate referenced comments are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site...
iDefense Security Advisory 04.14.09: Microsoft Word 2000 WordPerfect 6.x Converter Stack Corruption Vulnerability
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 iDefense Security Advisory 04.14.09 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 14, 2009 I. BACKGROUND Word 2000 is a word processing application included with the Microsoft Office 2000 software. The WordPerfect Converter is a tool used...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modif...
CVE-2008-6532
Multiple cross-site request forgery CSRF vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modif...
SA-CONTRIB-2009-015 - Tokenauth - Access bypass
The Token authentication module allows access to RSS feeds via a token without having to provide your username and password to the site. Token authentication did not properly use the Drupal Form API which would allow a malicious user to learn the site administrator's token giving them the ability...
SA-CONTRIB-2009-010 Plus 1 - Cross-site request forgery
The Plus 1 module provides a voting widget for content that records votes using Ajax. The URL for voting is vulnerable to cross-site request forgeries CSRF making it possible for users to unknowingly vote for content. Versions affected Versions of Plus 1 prior to 6.x-2.6 Drupal core is not...
Drupal Local File Inclusion Vulnerability (Windows)
Hi guys, I was testing Acunetix WVS with AcuSensor enabled on Drupal http://www.drupal.org and the scanner found a possible File Inclusion vulnerability. The vulnerability is located in the file "includestheme.inc" on line 1011. Vulnerable code: function themerendertemplate$templatefile, $variabl...
CVE-2008-6170
Cross-site scripting XSS vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title...
CVE-2008-6105
The CVE-2008-6105 entry affects IBM Workplace for Business Controls and Reporting 2.x and IBM Workplace Web Content Management 6.x with a cross-site scripting (XSS) vulnerability that allows remote injection of arbitrary script/HTML via unspecified vectors. NVD reports a base score of 4.3 (MEDIUM...
IBM AIX rmsock及rmsock64工具日志文件本地权限提升漏洞
IBM AIX是一款商业性质的UNIX操作系统。 IBM AIX系统中的rmsock及rmsock64工具实现上存在漏洞，可能允许本地攻击者利用此漏洞提升自己的权限。 rmsock及rmsock64工具没有以安全的方式创建日志文件，本地攻击者可能利用此漏洞向任意系统文件添加数据，导致权限提升。 IBM AIX 6.x IBM AIX 5.x 厂商补丁： IBM --- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://aix.software.ibm.com/aix/efixes/security/rmsockfix.tar...
SA-CORE-2009-001 Drupal core - Multiple vulnerabilities
Multiple vulnerabilities and weaknesses were discovered in Drupal. Access Bypass The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content a node. In that process the existing node's content is copied into the new node's submission form. The...
Sql injection
Multiple unspecified vulnerabilities in FreeBSD 6 before 6.4-STABLE, 6.3 before 6.3-RELEASE-p7, 6.4 before 6.4-RELEASE-p1, 7.0 before 7.0-RELEASE-p7, 7.1 before 7.1-RC2, and 7 before 7.1-PRERELEASE allow local users to gain privileges via unknown attack vectors related to function pointers that a...
SA-2008-071 - User Karma - Multiple vulnerabilities
The User Karma module displays and manages karma points of users. How karma points are calculated is defined by other modules which hook into the User Karma module. Unfortunately the User Karma module allows administrators to enter a list of content types and voting API values which are then used...
DZ! sodb-2 0 0 8-1 3 EXP published-vulnerability warning-the black bar safety net
!/ usr/bin/php ? php / Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp By www.80vul.com Notes the value of the variable, add your own modifications / $host = ‘www.80vul.com’; // Server domain or IP $path = ‘/discuz/’; // Where the program path $key = 0; // The above variable is edited, make will the value...
Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp-vulnerability warning-the black bar safety net
!/ usr/bin/php ? php / Discuz! 6. x/7. x SODB-2 0 0 8-1 3 Exp By www.80vul.com Notes the value of the variable, add your own modifications / $host = 'www.80vul.com'; // Server domain or IP $path = '/discuz/'; // Where the program path $key = 0; // The above variable is edited, make will the value...
