SA-CONTRIB-2010-018 - Content Distribution - Multiple Vulnerabilities

Content Distribution module allows calling a method to delete particular nodes using a XML-RPC call. When this method is allowed to be called by anonymous users in user permissions, an attacker might delete a random node. In addition, certain actions require Content Distribution to temporarily...

SA-CONTRIB-2010-010 - Author Contact - Cross site scripting

The Author Contact module provides a form to contact the author of the current post. The module does not properly sanitize parts of the provided block, leading to a cross-site scripting XSS vulnerability. Such an attack may lead to a malicious user gaining full administrative access. A user must...

SA-CONTRIB-2010-003 - Forward - Cross site scripting

This module allows users to forward a link to a specific node on your site to a friend. The Forward module does not properly sanitize user supplied data, allowing users with the "access administration pages" and "administer forward" permissions, or users with "access administration pages" and...

Drupal Sections Module XSS Vulnerability

Exploit for unknown platform in category web applications ======================================== Drupal Sections Module XSS Vulnerability ======================================== The text of this announcment is also available at http://www.madirish.net/?article=440 Description of Vulnerability:...

Drupal Sections Module XSS Vulnerability

No description provided by source. The text of this announcment is also available at http://www.madirish.net/?article=440 Description of Vulnerability: - - - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL that provides...

Drupal 6.14 with Sections 6.x-1.2 multiple XSS

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The text of this announcment is also available at http://www.madirish.net/?article=440 Description of Vulnerability: - - - ----------------------------- Drupal http://drupal.org is a robust content management system...

Drupal Module Sections - Cross-Site Scripting

Drupal Module Sections - Cross-Site Scripting The text of this announcment is also available at http://www.madirish.net/?article=440 Description of Vulnerability: - - - ----------------------------- Drupal http://drupal.org is a robust content management system CMS written in PHP and MySQL that...

SA-CONTRIB-2009-106 - Agreement - Cross Site Scripting

The Agreement module enables the display of a text-based agreement think "Terms of Service" that users of a particular role must accept before they are given access to the site. The module does not sanitize some of the user-supplied fields, leading to a Cross Site Scripting XSS vulnerability...

SA-CONTRIB-2009-092 - S5 Presentation Player Cross Site Scripting

The S5 Presentation Player module enables the creation of an S5 slideshow using content from the site. The module does not properly sanitize user supplied text it includes in the HTML HEAD section, leading to a cross-site scripting XSS vulnerability. Such an attack may lead to a malicious user...

SA-CONTRIB-2009-085 - Insert Node - Cross Site Scripting

The Insert Node module provides an input filter that enables a node to be inserted within the body field of another node. The module fails to sanitize the inserted node, making it vulnerable to a cross site scripting XSS attack. Versions affected Insert Node module versions for Drupal 5.x prior t...

SA-CONTRIB-2009-079 - vCard - Cross Site Scripting

The vCard module adds a vCard download link to every user's profile. This link makes it easy to add users from a Drupal site to a local address book. When the themevcard function is added to a theme and default content from the vCard module is output, the site will be vulnerable to Cross Site...

SA-CONTRIB-2009-075 - OG Vocabulary 5.x

The Organic Groups Vocabulary module enables an organic group to have a group specific vocabulary. In some specific cases, the module does not sanitize before outputting the group title, resulting in a cross-site scripting XSS vulnerability. Such an attack may lead to a malicious user gaining ful...

SLES9: Security update for postgresql

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: postgresql-devel postgresql-docs postgresql-pl postgresql-libs postgresql-server postgresql postgresql-contrib For more information, please visit the...

SLES9: Security update for PostgreSQL

The remote host is missing updates to packages that affect the security of your system. One or more of the following packages are affected: postgresql-libs postgresql-pl postgresql-devel postgresql-docs postgresql postgresql-server postgresql-contrib For more information, please visit the...

Mandriva Linux Security Advisory : php (MDVSA-2009:247)

Multiple vulnerabilities was discovered and corrected in php : The dbareplace function in PHP 5.2.6 and 4.x allows context-dependent attackers to cause a denial of service file truncation via a key with the NULL byte. NOTE: this might only be a vulnerability in limited circumstances in which the...

Fedora Core 11 FEDORA-2009-8184 (drupal-date)

The remote host is missing an update to drupal-date announced via advisory FEDORA-2009-8184. OpenVAS Vulnerability Test $Id: fcore20098184.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-8184 drupal-date Authors: Thomas Reinke Copyright: Copyright c...

SA-CONTRIB-2009-044 - Bubbletimer - Multiple vulnerabilities

Bubbletimer allows users to create timesheets based on nodes. It suffers from a cross-site scripting XSS vulnerability due to not properly sanitizing node titles before they are displayed. It is also vulnerable to cross-site request forgeries CSRF making it possible for users to unknowingly add...

SA-CONTRIB-2009-031 - Ajax Session - Multiple vulnerabilities

The Ajax session module allows users to set PHP session variables using AJAX. The module does not make proper use of the Drupal API, leaving it open to multiple vulnerabilities, including Cross Site Request Forgeries CSRF and Cross Site Scripting XSS. Versions affected Ajax Session 5.x-1.0 Drupal...

SA-CONTRIB-2009-023 - News Page - SQL injection

The News Page module provides a node content type which displays feed items from an aggregator category, filtered by keywords entered into the 'Include Words' field of the node. Unfortunately the News Page module uses keywords directly in SQL queries without being sanitized, allowing SQL injectio...

SA-CONTRIB-2009-021 CCK comment reference - Cross site scripting

CCK comment reference project, lets administrators define node fields that are references to comments. When displaying a node edit form, the titles of candidate referenced comments are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site...