CVE-2012-5553

CVE-2012-5553 relates to multiple XSS vulnerabilities in the Drupal OM Maximenu module. Affected software: OM Maximenu 6.x-1.x before 6.x-1.44 and 7.x-1.x before 7.x-1.44. The issue arises when authenticated users with the "administer OM Maximenu" permission can inject arbitrary web script or HTM...

CVE-2012-5559

CVE-2012-5559: Drupal ctools 6.x-1.x before 6.x-1.10 contains a cross-site scripting (XSS) vulnerability in the page manager node view task, exploitable by remote authenticated users with permissions to submit or edit nodes to inject arbitrary script via the page title. Fedora advisories and Drup...

CVE-2012-1599

CVE-2012-1599 affects Joomla! platforms: Joomla! 1.5.x before 1.5.26 and Joomla! 2.5.x before 2.5.4 are vulnerable due to a flawed permissions check that can disclose sensitive administrative back end information via unknown vectors. The issue is described as a possible duplicate of CVE-2012-1611...

CVE-2012-5539

The Drupal OG (Organic Groups) module for 7.x-1.x is vulnerable prior to 7.x-1.5. The flaw occurs in the handling of pending group memberships, allowing remote authenticated users to post to groups they are not properly authorized for by editing their own account while a pending membership is awa...

CVE-2012-5534

WeeChat vulnerability CVE-2012-5534 affects the hook_process() in the plugin API for versions 0.3.0–0.3.9.1, allowing remote command execution via shell metacharacters in a plugin-derived command (shell expansion). Impact described across several advisories: remote code execution or other effects...

CVE-2012-5552

Summary: The Password policy module for Drupal 6.x and 7.x contains a vulnerability where, when the module’s “previous passwords” feature is enabled, an attacker who can view HTTP traffic can obtain a user’s hashed password due to lack of encrypted transport. This affects: Drupal 6.x-1.x prior to...

CVE-2012-5554

The CVE-2012-5554 issue affects Webform CiviCRM Integration for Drupal 7.x-3.x. The vulnerability occurs when Enforce Permissions is disabled in versions 7.x-3.0 through 7.x-3.3, allowing remote attackers to read webforms and obtain contact information. The entry notes this affects configurations...

CVE-2012-5550

SQL injection vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-5549

CVE-2012-5549 : CSRF vulnerability in the Drupal contributed Time Spent module (6.x/7.x) allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. The Time Spent module had insufficient input sanitization, affecting all versions. Drupal core is not affected....

CVE-2012-5450

Cross-site request forgery CSRF vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple CMSMS 1.11.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary files via the deld parameter...

CVE-2012-5859

Samsung Kies Air (Android) versions 2.1.207051 and 2.1.210161 are affected by CVE-2012-5859, which allows remote attackers to cause a denial of service (crash) by sending a crafted request to /www/apps/KiesAir/jws/ssd.php. The issue, described as a DoS via a crafted HTTP request, is tied to Kies ...

CVE-2012-5550

Summary: CVE-2012-5550 describes a SQL injection vulnerability in the Drupal contributed Time Spent module (versions 6.x and 7.x). The underlying issue is that the module does not sufficiently sanitize user input, enabling remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-5557

The vulnerability CVE-2012-5557 affects the Drupal module User Read-Only (versions 6.x-1.x up to 6.x-1.4 and 7.x-1.x up to 7.x-1.4). The root cause is improper role assignment when more than three roles are configured, which could allow remote authenticated users to escalate privileges (demonstra...

CVE-2012-5537

The vulnerability CVE-2012-5537 affects the Simplenews Scheduler module for Drupal (6.x-2.x series) prior to 6.x-2.4. An authenticated user with the 'send scheduled newsletters' permission can inject arbitrary PHP code into the scheduling form, which is later executed by cron, enabling code execu...

CVE-2012-5543

The CVE-2012-5543 issue affects the Drupal Feeds module (7.x-2.x) prior to 7.x-2.0-alpha6. The root cause is improper permission checks when a field is mapped to the node author, enabling remote attackers to create arbitrary nodes via a crafted source feed. Affected software is the Feeds module f...

CVE-2012-5542

The vulnerability CVE-2012-5542 affects the Drupal Commerce Extra Panes module (7.x-1.x) prior to 7.x-1.1. The issue is a CSRF flaw that could allow an attacker to trick an administrator into enabling/disabling a Commerce extra panes pane via certain administrative actions (e.g., related to the l...

CVE-2012-5450

CMS Made Simple (CMSMS) prior to 1.11.2.1 is affected by a CSRF vulnerability in lib/filemanager/imagemanager/images.php (deld parameter) that allows an authenticated administrator to delete arbitrary files. The issue is documented as CVE-2012-5450 and is linked to a related directory-traversal c...

CVE-2012-5549

Cross-site request forgery CSRF vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-5551

CVE-2012-5551 affects the Drupal MailChimp module (7.x-2.x) prior to 7.x-2.7. The root cause is two XSS vectors: (1) a predictable webhook URL key and (2) improper sanitization of webhook variables coming from POST requests. This allows remote attackers to inject arbitrary scripts/HTML. Impact is...

CVE-2012-5545

The CVE affects the Drupal ShareThis module (7.x-2.x) prior to 7.x-2.5. The vulnerability is an XSS in the handling of JavaScript settings due to insufficient filtering of output. Exploitation requires an authenticated user with the 'administer sharethis' permission. A fixed version is ShareThis ...