CVE-2012-4479

SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4477

Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors...

CVE-2012-4475

CVE-2012-4475 affects the Drupal Security Questions module (versions 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1). The root cause is an inadequate access check, allowing remote attackers to edit an arbitrary user’s questions and answers via unspecified vectors. Impact is an access-bypass th...

CVE-2012-4469

The CVE-2012-4469 issue affects Drupal with the Hashcash contributed module (6.x-2.x and 7.x-2.x branches). The vulnerability is a cross-site scripting (XSS) flaw that occurs when the site’s Hashcash setting “Log failed hashcash” is enabled and an invalid token is processed, allowing an attacker ...

CVE-2012-4473

The CVE-2012-4473 vulnerability affects the Drupal contributed module Restrict node page view (7.x-1.x) prior to version 7.x-1.2. The underlying issue is that the module can grant access to unpublished nodes to remote authenticated users who have the permissions “view any node page” or “view any ...

CVE-2012-4561

Libssh: CVE-2012-4561 in libssh prior to 0.5.3 is caused by memory-management issues that free an invalid pointer on an error path, potentially enabling remote denial of service (crash). Several connected advisories also reference related CVEs (4559, 4560, 4562) and note memory-management flaws w...

CVE-2012-4477

Affected software: Drupal Drag & Drop Gallery module (6.x). Vulnerability type: Access bypass in the module’s handling of uploads and access controls (CVE-2012-4477). Root cause: unresolved access-control flaws in the Drag & Drop Gallery code path that can allow remote attackers to bypass restric...

CVE-2012-4471

The vulnerability CVE-2012-4471 affects the Drupal Search Autocomplete module for Drupal 7.x-2.x before 7.x-2.4, where access control to the module’s admin page is insufficiently restricted. This allows remote attackers to disable autocompletion or alter priority order via unspecified vectors. Th...

CVE-2012-4479

CVE-2012-4479 describes an SQL injection vulnerability in the Drupal contributed module Drag & Drop Gallery (6.x). The vulnerability is exploited via unspecified vectors, enabling remote attackers to run arbitrary SQL commands. Public advisories (Drupal SA-CONTRIB-2012-108) note multiple vulnerab...

CVE-2012-4478

The CVE-2012-4478 vulnerability is a CSRF flaw in Drupal’s Drag & Drop Gallery 6.x module that can enable remote attackers to hijack an administrator’s session. Affected component: Drag & Drop Gallery module (Drupal contrib) 6.x. Root cause: CSRF in the module’s handling of admin actions, allowin...

CVE-2012-4473

The Restrict node page view module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "view any node page" or "view any node type page" permission to access unpublished nodes via a direct request...

CVE-2012-4559

CVE-2012-4559 applies to the libssh library. The issue comprises multiple double-free vulnerabilities in components of libssh (e.g., agent_sign_data, channel_request, ssh_userauth_pubkey, sftp_parse_attr_3, and keyfiles.c) that could cause a crash and potentially allow arbitrary code execution. A...

CVE-2012-6063

Technical details about CVE-2012-6063 (affected software, root cause, impact, and fixes) are not publicly provided in the supplied documents. Monitor for updates in connected advisories.

CVE-2012-4468

Summary: CVE-2012-4468 is a cross-site scripting (XSS) vulnerability in the Drupal Privatemsg module. Affected software: Privatemsg 7.x-1.x before 7.x-1.3. Root cause: insufficient sanitization of the user name when creating private messages. Impact: remote attackers can inject arbitrary web scri...

CVE-2012-4474

CVE-2012-4474 : The Drupal contributed module Colorbox Node (7.x-2.x) is vulnerable to cross-site scripting (XSS) in versions prior to 7.x-2.2. The issue arises because the module did not adequately validate certain URL parameters before printing them to the browser, allowing an attacker to injec...

CVE-2012-4476

CVE-2012-4476 is an XSS vulnerability in the Drupal Drag & Drop Gallery module 6.x. The issue arises in the module’s file handling/uploads logic, with vectors not publicly specified in the provided docs. An advisory notes exploitation exists and that there is no patch; mitigation is to disable an...

CVE-2012-4470

The vulnerability CVE-2012-4470 affects the Listhandler module for Drupal (versions 6.x-1.x prior to 6.x-1.1). The root cause is an improper permissions check when importing emails, allowing remote comment authors to bypass access restrictions. This could enable unintended access or other unspeci...

CVE-2012-4551

The CVE-2012-4551 issue affects libunity-webapps before 2.4.1 and is a use-after-free vulnerability. According to multiple connected sources, it could be triggered by crafting a website to cause memory corruption, potentially leading to a denial of service and possibly arbitrary code execution. U...

CVE-2012-4560

CVE-2012-4560 refers to multiple memory-management vulnerabilities in libssh, including buffer overflows, reported in versions prior to 0.5.3. The public description notes that these flaws could allow a remote attacker to crash the library or possibly execute arbitrary code via unspecified vector...

CVE-2012-4571

Python Keyring 0.9.1 is affected by a weakness in how the encryption cipher is initialized for CryptedFileKeyring, enabling local users to recover passwords via brute force. The issue arises from insecure cipher initialization, not from remote access. Affected component: Python keyring library (C...