SA-CONTRIB-2009-034 - Taxonomy manager - Cross site scripting

The Taxonomy manager module provides additional tools for administering taxonomy through Drupal. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed. The module does not properly escape some user-supplied data...

CVE-2009-1844

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow 1 remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the...

CVE-2009-1844

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow 1 remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow 1 remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the...

DSA-1808-1 drupal6 - insufficient input sanitising

Bulletin has no description...

FreeBSD : drupal -- XSS (a6605f4b-4067-11de-b444-001372fd0af2)

The Drupal Security Team reports : When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input. Certain byte...

drupal -- cross-site scripting

The Drupal Security Team reports: When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input. Certain byte...

Drupal 5.17 Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Drupal 5.17 Taxonomy Core Module Contains XSS Vulnerability May 7, 2009 Version tested: Drupal 5.17 http://lampsecurity.org/drupal-taxonomy-vulnerability Drupal http://drupal.org is a robust content management system CMS written in PHP and supported b...

SA-CONTRIB-2009-018 - Feed element mapper - Cross site scripting

Feed element mapper is an Add-on module for FeedAPI that maps elements on a feed item such as tags or the author name to taxonomy or CCK fields. These mappings are configurable by point and click. The module does not escape content titles enabling malicious users to insert arbitrary HTML and...

CVE-2009-0818

Cross-site scripting XSS vulnerability in the taxonomythemeadmintablebuilder function taxonomythemeadmin.inc in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is...

Cross site scripting

Cross-site scripting XSS vulnerability in the taxonomythemeadmintablebuilder function taxonomythemeadmin.inc in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is...

CVE-2009-0818

The CVE-2009-0818 issue affects Drupal’s Taxonomy Theme module prior to 5.x-1.2, where the taxonomy_theme_admin_table_builder (taxonomy_theme_admin.inc) allows authenticated users with the "administer taxonomy" permission (or those who can create pages when tagging is enabled) to inject arbitrary...

CVE-2009-0818

Cross-site scripting XSS vulnerability in the taxonomythemeadmintablebuilder function taxonomythemeadmin.inc in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is...

Drupal Taxonomy Theme模块name参数HTML注入漏洞

BUGTRAQ ID: 33923 Drupal的Taxonomy Theme模块允许网站管理员基于分类、词汇或类型内容更改指定内容的主题。 Taxonomy Theme模块的taxonomythemeadmintablebuilder函数没有正确地检查用户提供输入。在taxonomythemeadmin.inc的388行： $form'table'$item-$data'key''title' = array'value' = $item-name; 由于没有使用checkplain或类似的函数对$item-name值执行过滤，拥有administer...

SA-CONTRIB-2009-008 - Taxonomy Theme - Cross site scripting

The Taxonomy Theme module allows a website adminstrator to change the theme of a given content item based on taxonomy, vocabulary or content type. It does not properly sanitize user-supplied data on a number of places. This allows users with the "administer taxonomy" permission, or, when tagging ...

Drupal Taxonomy Theme Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Version Tested: Taxonomy Theme 5.x-1.1 http://drupal.org/project/taxonomytheme Drupal 5.15 http://drupal.org Module maintainer and Drupal security team notified "The taxonomytheme module allows you to change the theme of a given node based on the...

CVE-2008-5996

Cross-site scripting XSS vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field...

Cross site scripting

Cross-site scripting XSS vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field...

CVE-2008-5996

Cross-site scripting XSS vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field...

[SECURITY] Fedora 10 Update: drupal-views-6.x.2.2-1.fc10

The views module provides a flexible method for Drupal site designers to control how lists of content nodes are presented. Traditionally, Drupal has hard-coded most of this, particularly in how taxonomy and tracker lists are formatted. This tool is essentially a smart query builder that, given...