Outline Designer - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-035

This module enables you to mass administer book outlines and perform common operations through one interface, improving the usability for the book module. The module doesn't sufficiently sanitize titles when presenting them on this interface. This vulnerability is mitigated by the fact that an...

TYPO3 Multiple Cross-Site Scripting Vulnerabilities (Jan 2016)

TYPO3 is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

VMware Player 7.x < 7.1.2 Shared Folders (HGFS) Guest Privilege Escalation (VMSA-2016-0001) (Linux)

The version of VMware Player installed on the remote host is version 7.x prior to 7.1.2. It is, therefore, affected by a guest privilege escalation vulnerability in the Shared Folders HGFS feature due to improper validation of user-supplied input. A local attacker can exploit this to corrupt...

Drupal Block Class Module HTML Injection Vulnerability

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. Block Class is one of the administrator through the Block configuration interface to add CSS to any Block module . An HTML injection vulnerability exists in Drupal Block Class modul...

Drupal Encrypt Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Encrypt is one of the API modules used to perform bidirectional data encryption. A security vulnerability exists in the Drupal Encrypt module version 7.x-2.x prior to 7.x-2.2. An attack...

Microsoft Internet Explorer Multiple Vulnerabilities (3104517)

This host is missing a critical security update according to Microsoft Bulletin MS15-112. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Login Disable - Access Bypass - Moderately Critical - SA-CONTRIB-2015-162

This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module doesn't support other contributed user authentication modules like CAS or URL Login. When combined with...

Drupal Colorbox Module Access Restriction Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. colorbox is one of the customizable jQuery popup box component modules. A security vulnerability exists in the Drupal Colorbox module 7.x-2.10 prior to version 7.x-2.x. A remote attack...

Drupal Scald Module Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP.Scald module for Drupal is a multimedia management module for Drupal. An information disclosure vulnerability exists in the Drupal Scald module version 7.x-1.5 and prior to version 7.x-1.x, which allows a remote attacker ...

Drupal Administration Views Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP.Administration Views module for Drupal is a module for Drupal that replaces the administration overview or listings pages. A security vulnerability in versions 7.x-1.x prior to 7.x-1.x of the Drupal Administration Views modu...

Drupal Search API Autocomplete Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search API Autocomplete is one of the modules used to add autocomplete functionality to search fields during searches and provide a list of suggestions. A cross-site scripting...

CVE-2015-0127

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted...

HP WebInspect 10.4 - XML External Entity Injection

HP WebInspect 10.4 - XML External Entity Injection Exploit Title: HP WebInspect - XML External Entity Date: 23\04\2015 Exploit Author: Jakub Palaczynski Vendor Homepage: http://www.hp.com/ Version: 10.4, 10.3, 10.2, 10.1, 10.0, 9.x, 8.x, 7.x CVE : CVE-2015-2125 1. Create website that exploits...

SA-CONTRIB-2015-077 - OG tabs - Cross Site Scripting (XSS)

OG Tabs modules provides a secondary menu with links to nodes of the same OG group. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission t...

Apache Tomcat Version 7.x Detection

Binary data 8928.prm...

SA-CONTRIB-2015-030 - Amazon AWS - Access bypass

Amazon AWS module provides integration with Amazon Web Services AWS. A malicious user could potentially guess an access token and trigger the creation of new backups by making a request to a specially-crafted URL. If the number of stored backups was limited, an attacker could exceed the limit by...

cURL / libcURL 7.x < 7.40.0 Remote Security Bypass

Binary data 8620.prm...

SA-CONTRIB-2015-009 - Linkit - Cross Site Scripting (XSS)

Linkit provides an easy interface for internal and external linking with wysiwyg editors and fields by using an autocomplete field. The module doesn't sufficiently sanitize node titles in the result list if the node search plugin is enabled. This vulnerability is mitigated by the fact that an...

SA-CONTRIB-2015-006 - Cloudwords for Multilingual Drupal - Multiple vulnerabilities

This module provides integration with the Cloudwords third-party service. The module was not sanitizing node titles on certain conditions, thereby leading to a Cross Site Scripting XSS vulnerability. Also, a menu callback was not protected against CSRF. The XSS vulnerability is mitigated by the...

SA-CONTRIB-2014-122 - MoIP - Cross Site Scripting (XSS)

This module enables you to use Moip a Brazilian payment method with Drupal Commerce. The module doesn't sufficiently filter the data passed by the automatic notifications, leaving the possibility for a malicious user to insert Cross Site Scripting xss attacks. This vulnerability is mitigated by t...