1063 matches found
SA-CONTRIB-2014-122 - MoIP - Cross Site Scripting (XSS)
This module enables you to use Moip a Brazilian payment method with Drupal Commerce. The module doesn't sufficiently filter the data passed by the automatic notifications, leaving the possibility for a malicious user to insert Cross Site Scripting xss attacks. This vulnerability is mitigated by t...
SA-CONTRIB-2014-123 - Postal Code - Cross Site Scripting (XSS)
The Postal Code module enables you to implement postal code validation for several countries. The module doesn't sufficiently sanitize certain data in the admin thereby opening a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role...
SA-CONTRIB-2014-124 - Poll Chart - Cross Site Scripting (XSS)
This module enables users to have a block displaying the result of the last poll as a chart. The module doesn't sufficiently sanitize poll node titles when displaying the block. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create polls and t...
Microsoft Internet Explorer Multiple Vulnerabilities (3008923)
This host is missing a critical security update according to Microsoft Bulletin MS14-080. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
SA-CONTRIB-2014-116 - Webform Invitation - Cross Site Scripting (XSS)
This module enables you to create custom invitation codes for Webforms. The module failed to sanitize node titles. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Webform: Create new content", "Webform: Edit own content" and/or "Webform: Edit any...
CVE-2014-9151
The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password...
CVE-2014-9016
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes aka phpass module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...
CVE-2014-9015
Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions...
Cross site request forgery (csrf)
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes aka phpass module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...
CVE-2014-9016
CVE-2014-9016 affects Drupal 7.x prior to 7.34 and the Secure Password Hashes (phpass) module 6.x-2.x prior to 6.x-2.1. The issue is a denial-of-service condition caused by the password hashing API, where a crafted request can exhaust CPU and memory. Remediation is to update to Drupal 7.34+ and p...
CVE-2014-9016
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes aka phpass module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service CPU and memory consumption via a crafted request...
Drupal Releases Security Advisory
Drupal has released an advisory to address multiple vulnerabilities in Drupal core 6.x versions prior to 6.34 and Drupal core 7.x versions prior to 7.34, one of which could allow a remote attacker to cause a denial of service. US-CERT encourages users and administrators to review Drupal's Securit...
SA-CONTRIB-2014-112 - Node Field - Cross Site Scripting (XSS)
Node Field module allows you to add custom extra fields to single Drupal nodes. The module doesn't sufficiently sanitize user input for some of the module's internal fields. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create nodes. CVE...
SA-CONTRIB-2014-114 - Tournament - Cross Site Scripting
This project allows you to create various types of tournaments as nodes and associated teams, tournaments, and matches. There are several cases in the project where an account username, node title, and team entity title are not correctly filtered before being displayed to a user. It is possible t...
CVE-2014-8734
The Organic Groups Menu aka OG Menu module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to change module settings via unspecified vectors...
Discuz 7.x /include/discuzcode.func.php 代码执行漏洞
No description provided by source...
Microsoft Internet Explorer Multiple Vulnerabilities (3003057)
This host is missing a critical security update according to Microsoft Bulletin MS14-065. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
SA-CONTRIB-2014-108 - Webform Component Roles - Access Bypass
The Webform component module enables site admins to limit visibility or editability of webform components based on user roles. The module doesn't sufficiently check that disabled component values are not modified upon submission of the form. CVE identifiers issued CVE-2014-9022 Versions affected...
Drupal 7.x /includes/database/database.inc SQL注入漏洞
Includes/database/database.inc protected function expandArguments&$query, &$args $modified = FALSE; foreach arrayfilter$args, 'isarray' as $key = $data $newkeys = array; foreach $data as $i = $value $newkeys$key . '' . $i = $value; $query = pregreplace'' . $key . '\b', implode', ',...
SA-CONTRIB-2014-105 - OG Menu - Access Bypass
OG Menu allows using menus within Organic Groups. The permissions for accessing the module settings were to broad, possibly granting access to users who would normally not be able to change the OG Menu configuration. This vulnerability is mitigated by the fact that an attacker must have a role wi...