CVE-2012-1590

The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page...

SA-CONTRIB-2012-093 - Node Embed - Access Bypass

Node Embed gives content editors an interface for selecting and embedding nodes using a WYSIWYG editor. The interface for selecting nodes is a page that had no access check, allowing users to view node titles they might not have access to. This issue only affects your site if you have unpublished...

RazorCMS <= 1.2.1 STABLE CSRF (Delete Web Pages)

Exploit for php platform in category web applications +------------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : RazorCMS body onload="javascrip...

Unfixed XSS vulnerability at ahpi.math.cnrs.fr

Security researcher Atmon3r, has submitted on 14/01/2012 a cross-site-scripting XSS vulnerability affecting ahpi.math.cnrs.fr, which at the time of submission ranked 14215 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 25/01/2012. It is...

FreeBSD - 'ftpd / ProFTPd' Remote Command Execution

/ KCOPE2011 - x86/amd64 bsd ftpd remote root exploit KINGCOPE CONFIDENTIAL - SOURCE MATERIALS This is unpublished proprietary source code of KINGCOPE Security. C COPYRIGHT KINGCOPE Security, 2011 All Rights Reserved bug found by Kingcope thanks to noone except alex whose damn down tested against:...

Joomla! Component Techfolio 1.0 - SQL Injection

Techfolio 1.0 Component Joomla SQL Injection Release Date Bug. 27-Oct-2011 Date Added. 30-Sep-2011 Vendor Notification Date. Never Product. Techfolio Platform. Joomla Affected versions. 1.0 Type. Non-Commercial Attack Vector. Sql Injection Solution Status. unpublished CVE reference. Not yet...

Unfixed XSS vulnerability at lepetitmarocain.net

Security researcher YB, has submitted on 20/09/2011 a cross-site-scripting XSS vulnerability affecting lepetitmarocain.net, which at the time of submission ranked 1673192 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 22/12/2011. It is current...

Unfixed XSS vulnerability at www.jesuspolice.com

Security researcher AR3SW0RMED, has submitted on 27/06/2011 a cross-site-scripting XSS vulnerability affecting www.jesuspolice.com, which at the time of submission ranked 2349652 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/12/2011. It is...

Unfixed XSS vulnerability at www.coffscoastadvocate.com.au

Security researcher Batch, has submitted on 05/07/2011 a cross-site-scripting XSS vulnerability affecting www.coffscoastadvocate.com.au, which at the time of submission ranked 586038 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 06/12/2011. I...

plone -- Remote Security Bypass

Plone developer reports: This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still ...

Google Urchin 5.7.03 Local File Inclusion

While fuzzing an Urchin web application, I discovered what appears to be an LFI vulnerability. Neither Secunia nor Google / Urchin appear to have reported this as a known issue. The problem lies in the gfid parameter passed to urchin.cgi. This was tested on a somewhat modified version of Urchin...

Unfixed XSS vulnerability at www.orland-press-register.com

Security researcher Devek, has submitted on 27/07/2010 a cross-site-scripting XSS vulnerability affecting www.orland-press-register.com, which at the time of submission ranked 1488652 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 15/12/2011. ...

Unfixed XSS vulnerability at www.nowplayingutah.com

Security researcher bho, has submitted on 13/07/2010 a cross-site-scripting XSS vulnerability affecting www.nowplayingutah.com, which at the time of submission ranked 720747 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/12/2011. It is...

SA-CONTRIB-2010-058: Chaos tool suite - Multiple vulnerabilities

The Chaos tool suite ctools is primarily a set of APIs and tools to improve the developer experience. This module was found to have multiple vulnerabilities. Cross site scripting XSS The module did not properly sanitize node titles under certain circumstances, resulting in multiple cross-site...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content...

CVE-2009-4517

Cross-site request forgery CSRF vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content...

CVE-2009-4517

The CVE-2009-4517 issue affects the Drupal module FAQ Ask (versions 5.x and 6.x prior to 6.x-2.0). It is a CSRF vulnerability that allows remote attackers to hijack the authentication of arbitrary users for requests accessing unpublished content. The vulnerability is network-exploitable with no r...

SA-CONTRIB-2009-067 Dex module - Cross Site Scripting, no longer maintained

The Dex: Contact Information Manager module enables contact information management with Google Maps and Yahoo Maps compatible geocoding. The module suffers from a Cross Site Scripting XSS vulnerability. Such an attack may lead to a malicious user gaining full administrative access. This module is...

Unfixed XSS vulnerability at www.mastrel.it

Security researcher jath, has submitted on 17/09/2009 a cross-site-scripting XSS vulnerability affecting www.mastrel.it, which at the time of submission ranked 6042718 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 19/09/2009. It is currently...

Unfixed XSS vulnerability at cyber.ob.tc

Security researcher Dark.Man, has submitted on 29/08/2009 a cross-site-scripting XSS vulnerability affecting cyber.ob.tc, which at the time of submission ranked 33439 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 13/01/2012. It is currently...