82 matches found
DRUPAL-CONTRIB-2019-092
The Smart Trim module allows site builders additional control with text summary fields. The module doesn't sufficiently filter text when certain options are selected. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content on the site when...
Smart Trim - Moderately critical - Cross site scripting - SA-CONTRIB-2019-092
The Smart Trim module allows site builders additional control with text summary fields. The module doesn't sufficiently filter text when certain options are selected. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content on the site when...
DRUPAL-CONTRIB-2019-050
This module enables you to handle fields for Custom Menu Links. The module doesn't sufficiently check requests to one of the module controllers if the user has permission 'administer menu'. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create...
[SECURITY] Fedora 30 Update: svgsalamander-1.1.2-1.fc30
SVG Salamander is an SVG engine for Java that's designed to be small, fast, and allow programmers to use it with a minimum of fuss. It's in particular targeted for making it easy to integrate SVG into Java games and making it much easier for artists to design 2D game content - from rich interacti...
UNL-CMS Cross-Site Request Forgery Vulnerability
UNL-CMS is a PHP-based content management system. A cross-site request forgery vulnerability exists in UNL-CMS version 7.59, which can be exploited by a remote attacker to create new content with the help of ?q=node%2Fadd%2Farticle&render=overlay&render=overlay URL...
CVE-2018-17069
An issue was discovered in UNL-CMS 7.59. A CSRF attack can create new content via ?q=node%2Fadd%2Farticle&render=overlay&render=overlay...
CVE-2018-17069
UNL-CMS 7.59 has a CSRF vulnerability that allows an attacker to create new content via the URL pattern ?q=node%2Fadd%2Farticle&render=overlay&render=overlay. The issue is documented across multiple sources (NVD, CNVD, CVE records, PRION, CVELIST) with the same vector and impact. Public details i...
DRUPAL-CONTRIB-2018-008
This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...
Panopoly Core - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-093
This module provides common functionality used by other modules in the Panopoly distribution and child distributions, like, Open Atrium. The module doesn't sufficiently filter node titles used in breadcrumbs when the "Append Page Title to Site Breadcrumb" setting is enabled. This vulnerability is...
CVE-2016-3162
The CVE-2016-3162 issue affects Drupal's File module (Drupal 7.x before 7.43 and 8.x before 8.0.4). The root cause is an access-control bypass that lets remote authenticated users who can create content or upload files read, delete, or substitute a link to a file uploaded to an unprocessed form. ...
CVE-2016-3162
Removed by vendor...
Cross site scripting
Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...
Secure Section Macro
panel:bgColor=e7f4fa NOTE: This suggestion is for Confluence Cloud. Using Confluence Server? See the corresponding suggestion|http://jira.atlassian.com/browse/CONFSERVER-23637. panel This is a suggestion to create a new Macro/Plugin that worked similar to the Column Macro with the major differenc...
Secure Section Macro
This is a suggestion to create a new Macro/Plugin that worked similar to the Column Macro with the major difference being when the user edits the Macro they are allowed to select user and group access options. The idea is that if the user/group is not selected in the access list then this Macro a...
Joomla! Component joomlacontenteditor - Blind SQL Injection
=================================================================== joomlacontenteditor comjce BLIND sql injection vulnerability =================================================================== Software: joomlacontenteditor comjce Vendor: www.joomlacontenteditor.net Vuln Type: BLind SQL...
CVE-2010-3327
The implementation of HTML content creation in Microsoft Internet Explorer 6 through 8 does not remove the Anchor element during pasting and editing, which might allow remote attackers to obtain sensitive deleted information by visiting a web page, aka "Anchor Element Information Disclosure...
RedShop 1.0.23.1 Joomla Component Blind SQL Injection Vulnerability
RedShop 1.0.23.1 Joomla Component Blind SQL Injection Vulnerability Name RedShop Vendor http://redweb.dk Versions Affected 1.0.23.1 Author Salvatore Fresta aka Drosophila Website http://www.salvatorefresta.net Contact salvatorefresta at gmail dot com Date 2010-07-13 X. INDEX I. ABOUT THE...
Joomla Redshop 1.0 SQL Injection
/ / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID ----------------------------------------------------------------------- Joomla...
Joomla! Component redSHOP 1.0 - pid SQL Injection
Joomla! Component redSHOP 1.0 - pid SQL Injection / / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID...
Joomla! Component redSHOP 1.0 - 'pid' SQL Injection
/ / / \ \ \ \ \ / / \\ \ \ \ \ // /// \ \ / / \ //|\ / \ \ \ \ \ \ / / \ \ / / \ | | | \ | | || | | |/ / \ V / || |\ V / / \ | / \ | /| | | || / | | | | . | ' || / | || // \ // \|||/|||||||||\ .WEB.ID ----------------------------------------------------------------------- Joomla...