103 matches found
CVE-2012-4490
The CVE-2012-4490 issue affects the Drupal Excluded Users module (versions 6.x-1.x prior to 6.x-1.1). It enables cross-site scripting via two input fields: user name and email address. The documented impact is client-side script/HTML injection (XSS) with no server-side impact specified beyond tha...
CVE-2012-4490: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the Excluded Users module 6.x-1.x before 6.x-1.1 for Drupal allow remote attackers to inject arbitrary web script or HTML via a 1 user name or 2 email address...
CVE-2012-3836
Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 groupname parameter in a savecategory in the users module; 2 virtualfilename, 3 branch, 4 contactperson, 5 street, 6 city, 7 province, 8 postal, 9...
CVE-2012-3836: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Baby Gekko before 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 groupname parameter in a savecategory in the users module; 2 virtualfilename, 3 branch, 4 contactperson, 5 street, 6 city, 7 province, 8 postal, 9...
CVE-2011-0911
Cross-site scripting XSS vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: it is possible that this overlaps CVE-2011-0535...
CVE-2011-0535
Cross-site request forgery CSRF vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit accesspermissions action to index.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: it is possible that this overlaps CVE-2011-0535...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit accesspermissions action to index.php...
CVE-2011-0911
CVE-2011-0911 (NVD entry) : Affected product is Zikula CMS, specifically the Users module, prior to version 1.2.5. It is described as a Cross-site Scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The root cause is not detai...
PT-2011-2429
Name of the Vulnerable Software and Affected Versions Zikula versions prior to 1.2.5 Description A cross-site request forgery CSRF issue exists in the Users module, allowing remote attackers to hijack administrator authentication for requests that modify account privileges. This is achieved by...
CVE-2011-0535: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change account privileges via an edit accesspermissions action to index.php...
CVE-2011-0911: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Users module in Zikula before 1.2.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: it is possible that this overlaps CVE-2011-0535...
PT-2011-2754
Name of the Vulnerable Software and Affected Versions Zikula versions prior to 1.2.5 Description A cross-site scripting XSS issue exists in the Users module, allowing remote attackers to inject arbitrary web script or HTML. This could potentially lead to unauthorized actions on the affected syste...
CVE-2010-1732: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the users module in Zikula Application Framework before 1.2.3 allows remote attackers to hijack the authentication of administrators for requests that change the administrator email address updateemail action...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...
CVE-2008-3101
Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...
CVE-2008-3101
Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...
CVE-2007-3616: Undefined Security Weakness
index.php in vtiger CRM before 5.0.3 allows remote authenticated users to perform administrative changes to arbitrary profile settings via a certain profilePrivileges action in the Users module...
CVE-2007-3598: Undefined Security Weakness
index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...