PT-2019-9589

Name of the Vulnerable Software and Affected Versions Tufin SecureTrack version 18.1 with TufinOS 2.16 build 1179Final Description A blind XXE vulnerability was discovered in the Audit Report module. This issue occurs when a new Best Practices Report is saved using a special payload inside the xm...

PT-2015-6573

Name of the Vulnerable Software and Affected Versions CiviCRM versions 6.x-1.x before 6.x-1.2 CiviCRM versions 7.x-1.x before 7.x-1.3 Description A cross-site request forgery CSRF issue exists in the private report module, allowing remote attackers to hijack user authentication for requests that...

CVE-2015-4391: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors...

Drupal CiviCRM private report module cross-site request forgery vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal CiviCRM private report, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform...

CVE-2009-4990

Cross-site scripting XSS vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission...

CVE-2009-4990

Cross-site scripting XSS vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission...

CVE-2009-4990

CVE-2009-4990 is an XSS vulnerability in Drupal’s Webform report module (5.x/6.x). The issue allows remote attackers to inject arbitrary web script or HTML via a submission. The connected documents confirm the affected product and vulnerability type but do not provide root-cause details, explicit...

CVE-2009-4990: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission...

Design/Logic Flaw

The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module entries...

CVE-2007-3617

The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module entries...

CVE-2007-3617

The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module entries...

CVE-2007-3617: Undefined Security Weakness

The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module entries...

CVE-2005-3545

SQL injection vulnerability in index.php of the report module in ibProArcade 2.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter...

CVE-2005-3545

SQL injection vulnerability in index.php of the report module in ibProArcade 2.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter...

PT-2005-4334 · Ib · Ibproarcade

Name of the Vulnerable Software and Affected Versions: ibProArcade versions 2.5.2 and earlier Description: A SQL injection issue exists in the report module of ibProArcade, allowing remote attackers to execute arbitrary SQL commands. The issue is related to the user parameter in the index.php fil...

CVE-2005-3545: Undefined Security Weakness

SQL injection vulnerability in index.php of the report module in ibProArcade 2.5.2 and earlier allows remote attackers to execute arbitrary SQL commands via the user parameter...