72 matches found
CVE-2007-6691
CVE-2007-6691 affects Menalto Gallery
FreeBSD : gallery2 -- multiple vulnerabilities (4aab7bcd-b294-11dc-a6f0-00a0cce0781e)
The Gallery team reports : Gallery 2.2.4 addresses the following security vulnerabilities : - Publish XP module - Fixed unauthorized album creation and file uploads. - URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink...
gallery2 -- multiple vulnerabilities
The Gallery team reports: Gallery 2.2.4 addresses the following security vulnerabilities: Publish XP module - Fixed unauthorized album creation and file uploads. URL rewrite module - Fixed local file inclusion vulnerability in unsecured admin controller and information disclosure in hotlink...
Drupal < 5.1 (post comments) Remote Command Execution Exploit v2
Exploit for unknown platform in category web applications ================================================================ Drupal new; $conn - proxy"http", "http://".$proxy."/" unless !$proxy; sub usage print "? Drupal \n"; print "? usage: perl $0 host directory proxy\n"...
Drupal < 5.1 (post comments) Remote Command Execution Exploit v2
No description provided by source. !/usr/bin/perl $Id: milw0rmdrupalv5.pl,v 0.2 2007/02/15 13:40:29 str0ke Exp $ milw0rmdrupalv5.pl - Drupal 5.1 Remote Command Execution Exploit Copyright c 2007 str0ke str0ke!milw0rm.com Description ----------- Previews on comments were not passed through normal...
Drupal < 4.7.6 (post comments) Remote Command Execution Exploit v2
Exploit for unknown platform in category web applications ================================================================== Drupal new; $conn - proxy"http", "http://".$proxy."/" unless !$proxy; sub usage print "? Drupal \n"; print "? usage: perl $0 host direct...
Drupal Comment Module comment_form_add_preview() Function Arbitrary Code Execution
The version of Drupal running on the remote host fails to properly validate previews on comments, and allows access to more than one input filter, which is not enabled by default. An attacker can exploit this issue by previewing a comment to have it interpreted as PHP code, resulting in arbitrary...
Input validation
The commentformaddpreview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form...
CVE-2007-0626
The commentformaddpreview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form...
DRUPAL-SA-2007-005 - Drupal core - Arbitrary code execution
Previews on comments were not passed through normal form validation routines, enabling users with the 'post comments' permission and access to more than one input filter to execute arbitrary code. By default, anonymous and authenticated users have access to only one input format. Immediate...
