7173 matches found
CVE-2009-2385
SQL injection vulnerability in the awardsMembers function in Sources/Profile.php in the Member Awards component 1.0.2 for Simple Machines Forum SMF allows remote attackers to execute arbitrary SQL commands via the id parameter in a profile action to index.php. NOTE: some of these details are...
CVE-2009-2373
Drupal 6.x: The Forum module is vulnerable to Cross-Site Scripting (XSS) via unspecified vectors, affected up to version 6.12/6.13 (per description: before 6.13). This allows remote attackers to inject arbitrary web script or HTML. Connected advisories confirm CVE-2009-2373 and reference Drupal f...
CVE-2009-2371
The CVE-2009-2371 entry affects the Drupal module Advanced Forum (6.x) prior to 6.x-1.1. The issue arises when the module allows users to modify their signatures after the comment format has been switched to an administrator-controlled input format, enabling remote authenticated users to inject a...
CVE-2009-2370
Cross-site scripting XSS vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2009-2370
CVE-2009-2370 affects the Drupal Advanced Forum module (versions 5.x prior to 5.x-1.1 and 6.x prior to 6.x-1.1). It is an XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Connected documents corroborate the fixed versions for the vulne...
CVE-2009-2373
Cross-site scripting XSS vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2009-2385
CVE-2009-2385 affects Simple Machines Forum (SMF) — Member Awards component 1.0.2. The vulnerability lies in the awardsMembers function in Sources/Profile.php, where the id parameter in a profile action to index.php can be exploited to perform SQL injection and execute arbitrary SQL commands. Thi...
CVE-2009-2355
The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service application crash by specifying 1 an empty string or 2 a non-numeric string when selecting a forum, related to the fmessagelist function...
Design/Logic Flaw
The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service application crash by specifying 1 an empty string or 2 a non-numeric string when selecting a forum, related to the fmessagelist function...
CVE-2009-2355
NullLogic Groupware 1.2.7 is affected by CVE-2009-2355 in the forum module: remotely authenticated users can crash the application by passing an empty string or a non-numeric string when selecting a forum (fmessagelist). The underlying issue is input handling in the forum selection path, as docum...
CVE-2009-2355
The forum module in NullLogic Groupware 1.2.7 allows remote authenticated users to cause a denial of service application crash by specifying 1 an empty string or 2 a non-numeric string when selecting a forum, related to the fmessagelist function...
Sql injection
SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum parameter...
CVE-2009-2326
Multiple SQL injection vulnerabilities in KerviNet Forum 1.1 and earlier allow remote attackers to execute arbitrary SQL commands via 1 an enterparol cookie to index.php in an auto action or 2 the topic parameter to message.php. NOTE: vector 2 can be leveraged for a cross-site scripting XSS attac...
CVE-2009-2329
KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 admin/head.php, or 2 votingdiagram.php, 3 voting.php, 4 topicssearch.php, 5 topicslist.php, 6 toppart.php, 7 quicksearch.php, 8 quickreply.php, 9 modermenu.php, 10 messageslist.php, 11...
Sql injection
admin/edituser.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the deluserid parameter...
CVE-2007-6727
SQL injection vulnerability in topic.php in KerviNet Forum 1.1 allows remote attackers to execute arbitrary SQL commands via the forum parameter...
CVE-2009-2327
Cross-site scripting XSS vulnerability in addvoting.php in KerviNet Forum 1.1 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the vvariant1 parameter...
CVE-2009-2328
admin/edituser.php in KerviNet Forum 1.1 and earlier does not require administrative authentication, which allows remote attackers to delete arbitrary accounts and conduct SQL injection attacks via the deluserid parameter...
Information disclosure
KerviNet Forum 1.1 and earlier allows remote attackers to obtain sensitive information via a direct request to 1 admin/head.php, or 2 votingdiagram.php, 3 voting.php, 4 topicssearch.php, 5 topicslist.php, 6 toppart.php, 7 quicksearch.php, 8 quickreply.php, 9 modermenu.php, 10 messageslist.php, 11...
