Silverstripe <= v2.3.4: two XSS vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Silverstripe CMS, http://silverstripe.org/, version 2.3.4 and lower and its unreleased 2.4 branch, is vulnerable to two Cross Site Scripting issues. 1. The comment posting mechanism of Silverstripe 'PostCommentForm' fails to properly sanitize the...

Silverstripe CMS 2.3.4 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Silverstripe CMS, , version 2.3.4 and lower and its unreleased 2.4 branch, is vulnerable to two Cross Site Scripting issues. 1. The comment posting mechanism of Silverstripe 'PostCommentForm' fails to properly sanitize the 'CommenterURL' parameter...

Sql injection

Multiple SQL injection vulnerabilities in modules/forum/post.php in RunCMS 2M1 allow remote authenticated users to execute arbitrary SQL commands via 1 the pid parameter, which is not properly handled by the store function in modules/forum/class/class.forumposts.php, or 2 the topicid parameter...

CVE-2009-3804

Multiple SQL injection vulnerabilities in modules/forum/post.php in RunCMS 2M1 allow remote authenticated users to execute arbitrary SQL commands via 1 the pid parameter, which is not properly handled by the store function in modules/forum/class/class.forumposts.php, or 2 the topicid parameter...

RunCMS 2m1 - 'store()' SQL Injection

postid.", pid=".$this-pid.", topicid=".$this-topicid.", forumid=".$this-forumid.", posttime=$datetime, uid=".$this-uid.", posterip='".$this-posterip."', subject='".$subject."', posttext='".$posttext."', allowhtml=".intval$this-allowhtml.", allowsmileys=".intval$this-allowsmileys.",...

RunCMS 2ma - 'post.php' SQL Injection

query$sql redirectheader"index.php", 2, MDCANTGETFORUM; exit; ... 'forum' variable is taken from $POST array and inserted in a sql query without prior santization and without being surrounded by quotes. Then you can subsequently manipulate this query in /modules/forum/class/class.permissions.php ...

NullLogic Groupware <= 1.2.7 Multiple Vulnerabilities - Linux

NullLogic Groupware is prone to multiple vulnerabilities. This VT has been deprecated and merged into the VT SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

FreeBSD : drupal -- multiple vulnerabilities (be927298-6f97-11de-b444-001372fd0af2)

The Drupal Security Team reports : Cross-site scripting The Forum module does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert arbitrary HTML and script code into forum pages...

NullLogic Groupware多个远程安全漏洞

CVECAN ID: CVE-2009-2354,CVE-2009-2355,CVE-2009-2356 Groupware是一个开源的团队协作软件，包含有即时消息、公共论坛、邮件等多种功能。 远程攻击者可以通过向Groupware的多个模块提交恶意参数请求导致拒绝服务或执行任意代码。 1 Groupware在与数据库服务器通讯时通常会调用sqlqueryf函数，该函数会使用C格式字符串和其他参数来创建SQL查询。例如，在试图登录的时候，authcheckpass函数会生成以下查询： if sqr=sqlqueryfsid, "SELECT userid, password FROM...

Sql injection

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355...

CVE-2009-2402

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355...

CVE-2009-2402: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in the forum module in PHPEcho CMS 2.0-rc3 allows remote attackers to execute arbitrary SQL commands via the id parameter in a thread action, a different vector than CVE-2008-0355...

CVE-2009-2373

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2373

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2373

Drupal 6.x: The Forum module is vulnerable to Cross-Site Scripting (XSS) via unspecified vectors, affected up to version 6.12/6.13 (per description: before 6.13). This allows remote attackers to inject arbitrary web script or HTML. Connected advisories confirm CVE-2009-2373 and reference Drupal f...

CVE-2009-2373

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2009-2373: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service application crash by specifying 1 an empty string or 2 a non-numeric string when selecting a forum, related to the fmessagelist function...

CVE-2009-2355

The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service application crash by specifying 1 an empty string or 2 a non-numeric string when selecting a forum, related to the fmessagelist function...