60 matches found
CVE-2012-2298
Multiple cross-site scripting XSS vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 "user names in page titles" and 2 "autocomplete callbacks."...
CVE-2012-2298
The CVE-2012-2298 issue concerns vulnerabilities in the Drupal RealName module (6.x-1.x) prior to 6.x-1.5. The root cause is inadequate escaping of user-provided data, enabling remote attackers to inject arbitrary script/HTML via two vectors: (1) user names in page titles and (2) autocomplete cal...
CVE-2012-2298
Multiple cross-site scripting XSS vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 "user names in page titles" and 2 "autocomplete callbacks."...
PT-2012-3932
Name of the Vulnerable Software and Affected Versions Drupal RealName module versions 6.x-1.x before 6.x-1.5 Description The issue allows remote attackers to inject arbitrary web script or HTML via vectors related to 1 user names in page titles and 2 autocomplete callbacks, specifically in the...
CVE-2012-2298: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 "user names in page titles" and 2 "autocomplete callbacks."...
SA-CONTRIB-2012-104 - Privatemsg - Cross Site Scripting (XSS)
The Privatemsg module allows users to send private messages between to each other. The module doesn't sufficiently sanitize user names when creating messages. This vulnerability is mitigated by the fact that it is not possible to create insecure user names through the default user interface. The...
SA-CONTRIB-2012-063 - RealName - Cross Site Scripting (XSS)
CVE: CVE-2012-2298 This module allows you to set a pattern for constructing "Real names" for users out of profile fields. The module does not sufficiently escape users' real names under certain circumstances which could lead to a Cross-Site Scripting XSS attack. Versions affected RealName 6.x-1.x...
CVE-2012-2156
Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...
PT-2012-3843
Name of the Vulnerable Software and Affected Versions Plume CMS versions 1.2.4 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting XSS attacks. This can be achieved via the u email parameter also known as th...
Drupal's <= v6.x-1.0 Realname User Reference Widget contributed module
Exploit for unknown platform in category web applications ====================================================================== Drupal's Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easily...
Drupal Realname User Reference Information Disclosure
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easil...
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module (version 6.x-1.0)
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella [email protected] Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a...
Cross site scripting
Cross-site scripting XSS vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname aka real name element...
CVE-2009-4524
Cross-site scripting XSS vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname aka real name element...
CVE-2009-4524
Cross-site scripting XSS vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname aka real name element...
CVE-2009-4524
CVE-2009-4524 affects the Drupal RealName module (6.x-1.x) prior to 6.x-1.3. It is a Cross-site Scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the realname element. The entry lists a MEDIUM impact with a base score of 4.3 (NVD), but exploitat...
CVE-2009-4524: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname aka real name element...
SA-CONTRIB-2009-072 - RealName - Cross Site Scripting
The RealName module allows the administrator to choose fields from the user profile that will be used to add a "real name" element method to a user object. In some specific cases, the module does not sanitize before outputting the realname, resulting in a cross-site scripting XSS vulnerability...
CVE-2006-1815
Multiple cross-site scripting XSS vulnerabilities in register.php in Tritanium Bulletin Board TBB 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 newuserrealname and 2 newusericq parameters, a different vector than CVE-2006-1768. NOTE: the provenance of this...
CVE-2006-0443: Undefined Security Weakness
Cross-site scripting XSS vulnerability in archive.php in CheesyBlog 1.0 allows remote attackers to inject arbitrary web script or HTML via the 1 realname and 2 comment parameters, or 3 via a javascript URI in the url parameter, when adding a comment...