1063 matches found
Sonicwall GMS 7.x - Filter Bypass & Persistent Vulnerability (0Day)
No description provided by source...
SmarterMail 7.x (7.2.3925) - Stored Cross Site Scripting Vulnerability
No description provided by source...
SmarterMail 7.x (7.2.3925) LDAP Injection Vulnerability
No description provided by source...
PHPNuke 7.x Content Filtering Byapss Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/15855/info PHPNuke is prone to a content filtering bypass vulnerability. This issue can allow an attacker to bypass content filters and potentially carry out cross-site scripting, HTML injection and other attacks. PHPNuke...
Apple QuickTime "_Marshaled_pUnk" Backdoor Param Client-Side Arbitrary Code Execution
No description provided by source. Original Source: http://reversemode.com/index.php?option=comcontent&task=view&id=69&Itemid=1 Victim prerequisites: Internet Explorer. XP,Vista,W7. Apple Quicktime 7.x, 6.x 2004 versions are also vulnerable, older versions not checked 1. Victim is enticed into...
Adobe Acrobat Reader 7-9 - U3D BoF
No description provided by source. Copyright c 2009, Felipe Andres Manzano [email protected] All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source...
Adobe Acrobat Reader All Version <9.x - Memory Corruption
No description provided by source. --------------------------------------------------------------------------- Title : Adobe Acrobat Reader All Version memory corruption Product: Adobe Acrobat Reader Product Homepage: www.adobe.com...
SA-CONTRIB-2014-065 - Custom Meta - Cross Site Scripting (XSS)
The module allows you to define and manage custom meta tags. The module does not sufficiently sanitize user input before displaying the attribute and content values for meta tags on the administration page. This vulnerability is mitigated by the fact that an attacker must have access to an accoun...
SA-CONTRIB-2014-059 - Touch Theme - Cross Site Scripting (XSS)
Touch Theme is a light weight theme with modern look and feel. The theme does not sufficiently sanitize theme settings input for Twitter and Facebook username. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer themes". CVE identifiers...
SA-CONTRIB-2014-060- Petitions - Cross Site Request Forgery (CSRF)
This distribution enables you to build an application that lets users create and sign petitions. The contained whpetitions module doesn't sufficiently verify the intent of the user when signing a petition. A malicious user could trick another user into signing a petition they did not intend to si...
Apple iOS 7.x < 7.1.1 Multiple Vulnerabilities
Binary data 8275.prm...
SA-CONTRIB-2014-058 - Webserver Auth - Access Bypass
This module allows you to delegate user authentication to the web server. The module can be configured to automatically create users that have been authenticated by the web server. There was an issue where a configuration variable did not have consistent default values in the code meaning that in...
SA-CONTRIB-2014-057 - Password policy - General logic error
This module enables you to define password policies with various constraints on allowable user passwords. The history constraint, when enabled, disallows a user's password from being changed to match a specified number of their previous passwords. Beginning with Password Policy 7.x-1.4, the histo...
SA-CONTRIB-2014-054 - Views - Access Bypass
The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. The module doesn't sufficiently check handler access when returning the list of handlers from viewplugindisplay::gethandlers. The...
SA-CONTRIB-2014-053 - Field API Tab Editor (FATE) - Access bypass
This module allows each entity field to be individually edited via its own custom page, accessible via a tab on the entity's page. The module returns an incorrect value to hookmenu if the current user does not have access to edit the entity. This allows users who would not normally have access to...
SA-CONTRIB-2014-048 - Field API Pane Editor (FAPE) - Access bypass
This module adds a contextual menu to fields which are added to an entity display in Panels, allowing individual fields to be directly edited via a separate page or, if it is enabled, the Overlay module. The module doesn't sufficiently verify the user has access to modify the entity the field is...
CVE-2013-7064
Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...
CVE-2013-7064
Cross-site scripting XSS vulnerability in the EU Cookie Compliance module 7.x-1.x before 7.x-1.12 for Drupal allows remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values...
CVE-2014-2715
Multiple cross-site scripting XSS vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the 1 module or 2 message parameter to index.php...
Input validation
Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...