CVE-2009-1085

CVE-2009-1085 affects Piwik 0.2.32 and earlier. The issue is improper access control that stores sensitive information (including the API key) under the web root, enabling remote attackers to obtain it via a direct request for misc/cron/archive.sh. The connected records confirm the same descripti...

CVE-2009-1085: Undefined Security Weakness

Piwik 0.2.32 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the API key and other sensitive information via a direct request for misc/cron/archive.sh...

SA-2008-038 - Services - Arbitrary code execution

The Services module package was created out of a need for a standardized solution to integrate external applications with Drupal. It builds on concepts from Drupal core's XMLRPC interface, but abstracts service callbacks so that they may be used with multiple interfaces such as XMLRPC, SOAP, REST...