4515 matches found
Drupal 7.x < 7.60 / 8.5.x < 8.5.8 / 8.6.x < 8.6.2 Drupal Multiple Vulnerabilities (SA-CORE-2018-006)
According to its self-reported version, the instance of Drupal running on the remote web server is 7.x prior to 7.60, 8.5.x prior to 8.5.8, or 8.6.x prior to 8.6.2. It is, therefore, affected by multiple vulnerabilities. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
Drupal Core Multiple Security Vulnerabilities (SA-CORE-2018-006) - Windows
Drupal is prone to multiple security vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
HTML Mail - Critical - Remote Code Execution - SA-CONTRIB-2018-069
The HTML Mail module lets you theme your messages the same way you theme the rest of your website. When sending email some variables were not being sanitized for shell arguments, which could lead to remote code execution. This issue is related to the Drupal Core release SA-CORE-2018-006...
Workbench Moderation - Moderately critical - Access bypass - SA-CONTRIB-2018-067
The Workbench Moderation module adds arbitrary moderation states to Drupal core's "unpublished" and "published" node states, and affects the behavior of node revisions when nodes are published. In some conditions, content moderation fails to check a users access to use certain transitions, leadin...
Search Autocomplete - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-070
This Search Autocomplete module enables you to autocomplete textfield using data from your website nodes, comments, etc... The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting XSS vulnerability. This vulnerability can be exploit...
Cisco Prime Infrastructure TFTP Arbitrary File Upload and Command Execution Vulnerability (cisco-sa-20181003-pi-tftp)
The Cisco Prime Infrastructure application running on the remote host is affected by an arbitrary file upload flaw, which could lead to a remote code execution vulnerability. This is due to incorrect permissions for various system folders, which a file could be uploaded to via TFTP. The commands ...
NVP field - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-066
NVP field module allows you to create a field type of name/value pairs, with custom titles and easily editable rendering with customizable HTML/text surrounding the pairs. The module doesn't sufficiently handle sanitization of its field formatter's output. This vulnerability is mitigated by the...
Cisco IOS Software IPv6 Hop-by-Hop DoS Vulnerability (cisco-sa-20180926-ipv6hbh)
According to its self-reported version, the IOS is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...
Cisco IOS XE Software OSPFv3 DoS Vulnerability (cisco-sa-20180926-ospfv3-dos)
According to its self-reported version, the IOS XE is affected by one or more vulnerabilities. Please see the included Cisco BIDs and the Cisco Security Advisory for more information. TRUSTED...
The vulnerability of the Intel-SA-00086 Detection Tool arises from privilege management errors, allowing a perpetrator to execute arbitrary code.
The vulnerability of the Intel-SA-00086 Detection Tool arises from privilege management errors. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
Printer, email and PDF versions - Highly critical - Remote Code Execution - SA-CONTRIB-2018-063
This module provides printer-friendly versions of content, including send by e-mail and PDF versions. The module doesn't sufficiently sanitize the arguments passed to the wkhtmltopdf executable, allowing a remote attacker to execute arbitrary shell commands. It also doesn't sufficiently sanitize...
Commerce Klarna Checkout - Moderately critical - Access bypass - SA-CONTRIB-2018-062
The Commerce Klarna Checkout module enables you to accept payments from the Klarna Checkout payment provider The module doesn't sufficiently validate the payment callback made by Klarna. An attacker could bypass the payment step...
CVE-2018-17003: Improper Neutralization of Input During Web Page Generation
In LimeSurvey 3.14.7, HTML Injection and Stored XSS have been discovered in the appendix via the surveylstitle parameter to /index.php?r=admin/survey/sa/insert...
PT-2018-13823
Name of the Vulnerable Software and Affected Versions LimeSurvey version 3.14.7 Description A security issue has been found in LimeSurvey, where HTML Injection and Stored XSS can be executed via the surveyls title parameter to the "/index.php?r=admin/survey/sa/insert" API endpoint. Recommendation...
Renderkit - Moderately critical - Access bypass - SA-CONTRIB-2018-060
This module, typically in combination with cfr:cfrplugin, allows to compose behaviors from granular components. One of such behaviors is to display a list of related entities, for a given source entity and a given entity relation e.g. an entity reference field. The components that display related...
[SECURITY] [DLA 1506-1] intel-microcode security update
Package : intel-microcode Version : 3.20180807a.1deb8u1 CVE ID : CVE-2018-3615, CVE-2018-3620, CVE-2018-3646 CVE-2018-3639, CVE-2018-3640, CVE-2017-5715 Security researchers identified speculative execution side-channel methods which have the potential to improperly gather sensitive data from...
CVE-2018-3686
Code injection vulnerability in INTEL-SA-00086 Detection Tool before version 1.2.7.0 may allow a privileged user to potentially execute arbitrary code via local access...
CVE-2018-3686
Code injection vulnerability in INTEL-SA-00086 Detection Tool before version 1.2.7.0 may allow a privileged user to potentially execute arbitrary code via local access...
