CVE-2010-1303

Multiple cross-site scripting XSS vulnerabilities in the Taxonomy Filter module 6.x before 6.x-1.1 for Drupal allow remote authenticated users, with administer taxonomy permissions or create node permissions when free tagging is enabled, to inject arbitrary web script or HTML via vocabulary 1...

CVE-2010-1303

Affected product: Drupal Taxonomy Filter module 6.x (before 6.x-1.1). Vulnerable component: vocabulary names, terms, and filter menus allow cross-site scripting via free tagging. Root cause: multiple XSS vulnerabilities enabling injection of arbitrary web script/HTML by remote authenticated users...

CVE-2009-4110

Cross-site scripting XSS vulnerability in the search functionality in DotNetNuke 4.8 through 5.1.4 allows remote attackers to inject arbitrary web script or HTML via search terms that are not properly filtered before display in a custom results page...

Mandriva Security Advisory MDVSA-2009:289 (kernel)

The remote host is missing an update to kernel announced via advisory MDVSA-2009:289. OpenVAS Vulnerability Test $Id: mdksa2009289.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:289 kernel Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft In...

Gentoo Security Advisory GLSA 200608-25 (xorg-x11, xorg-server, xtrans, xload, xinit, xterm, xf86dga, xdm, libX11)

The remote host is missing updates announced in advisory GLSA 200608-25. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross site scripting

Cross-site scripting XSS vulnerability in the Suggested Terms module 5.x before 5.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via crafted Taxonomy terms...

CVE-2008-3500

Cross-site scripting XSS vulnerability in the Suggested Terms module 5.x before 5.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via crafted Taxonomy terms...

CVE-2008-3500

CVE-2008-3500 is an XSS vulnerability in the Drupal Suggested Terms module 5.x up to before 5.x-1.2. The flaw lets remote authenticated users inject arbitrary web script or HTML by crafting Taxonomy terms. Documented impact is cross-site scripting; no exploit details or in-the-wild status are pro...

CVE-2008-3500

Cross-site scripting XSS vulnerability in the Suggested Terms module 5.x before 5.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via crafted Taxonomy terms...

CVE-2008-3218

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

CVE-2008-3218

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

CVE-2008-3218

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

BusyBox (uname) Local Format String Exploit

No description provided by source. / lul-busybox.c copyright C 2008 lul-disclosure inc. All rights reserved. this code is distributed with the LPL license agreement http://lul-disclosure.net/LPL.txt moar commonly known as the EULA Epic User License Agreement busybox uname format string exploit by...

Drupal Suggested Terms模块多个HTML注入漏洞

BUGTRAQ ID: 29953 Drupal是一款开放源码的内容管理平台。 Drupal的suggested terms模块用于根据用户已提交过的术语提供可自由标记的分类字段。该模块未经正确地过滤便在可点击的列表中显示了分类术语，因此能够创建新的术语条目的用户可以向某些编辑页面中注入任意HTML和脚本代码，当用户查看所推荐的分类术语时就会在浏览器会话中执行这些代码。 Drupal Suggested Terms 5.x-1.1 Drupal ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.drupal.org/...

SA-2008-039 - Suggested terms - Cross site scripting

This module provides "suggested terms" for free-tagging Taxonomy fields based on terms already submitted. Taxonomy terms as presented in the clickable list are not properly sanitized. Users who are able to create new terms are able to insert arbitrary script code and HTML into certain edit pages...

WordPress wp-db.php文件字符集SQL注入漏洞

BUGTRAQ ID: 26795 WordPress是一款免费的论坛Blog系统。 WordPress处理用户数据时存在漏洞，远程攻击者可能利用此漏洞执行SQL注入攻击。 WordPress中的大多数数据库查询使用escape方式过滤SQL字符串，实际上是通过addslashes函数过滤输入，而addslashes函数没有考虑SQL字符串中所使用的字符集，盲目的向单引号前插入反斜线，这样的反斜线可能会形成其他有效的字符。以下是wp-includes/query.php中的漏洞代码： // If a search pattern is specified, load the posts...

wordpress-toolkit-gui.txt

Copyright c 2007 Lance M. Havok . All Rights Reserved. Exploits R' Us: bringing the amazing world of exploitation toys to your mom. Please read http://www.info-pull.com/code/DISCLAIMER for licensing terms. begin require 'pwnpress' require 'rubygems' require 'fox16' include Fox rescue puts "Need...

CVE-2007-2432

CVE-2007-2432 is an XSS vulnerability in nukedit 4.9.7b affecting the utilities/search.asp endpoint, exploitable via the terms parameter to inject arbitrary web script/HTML. The provided documents consistently describe a client-side/script injection risk without detailing exploitation status or p...

FreeBSD : phpwebftp -- 'language' Local File Inclusion (d9dc2697-dadf-11da-912f-00123ffe8333)

Secunia reports : phpWebFTP have a vulnerability, which can be exploited by malicious people to disclose sensitive information. Input passed to the 'language' parameter in index.php isn't properly verified, before it is used to include files. This can be exploited to include arbitrary files from...