860 matches found
SA-CONTRIB-2009-021 CCK comment reference - Cross site scripting
CCK comment reference project, lets administrators define node fields that are references to comments. When displaying a node edit form, the titles of candidate referenced comments are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site...
SA-CONTRIB-2009-013 CCK - Cross site scripting
The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate...
SA-CONTRIB-2009-009 Forward module can be used as a spam relay
This vulnerability allows spammers or spambots to use sites with the Forward module installed to send nearly unlimited e-mail. Due to improper use of Drupal's flood control API, it is possible for one user to send an unlimited numbers of mails using the forward module. Important note : the securi...
Fedora Update for quagga FEDORA-2007-2196
Check for the Version of quagga OpenVAS Vulnerability Test Fedora Update for quagga FEDORA-2007-2196 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...
SA-CONTRIB-2009-007 - Advertisement Cross-site scripting
The Advertisement module displays and tracks advertisements on Drupal websites. Unsanitized text is displayed in several places, allowing users with "administer advertisements" permissions to execute arbitrary code. Users with "administer advertisements" permissions have the ability to configure...
SA-CONTRIB-2009-005 - Views bulk operations - Cross site scripting
Views bulk operations augments Views by enabling bulk operations to be executed on the content displayed by a view. Views bulk operations does not properly escape user-supplied data on some pages, allowing malicious users to insert arbitrary HTML and script code into these pages. Such a cross sit...
SA-CONTRIB-2009-004 - Notify - Privilege escalation
A user triggering the cron processing of the Notify module may end up getting logged in as another user when the Notify operations do not complete succesfully. Versions Affected Versions of Notify for Drupal 5.x prior to 5.x-1.2 Drupal core is not affected. If you do not use the Notify module,...
SA-CONTRIB-2009-001 - Project release - Multiple vulnerabilities
Exploitable from: Remote Vulnerabilities: Arbitrary file upload, Cross-site scripting XSS The Project release module is a component within the broader Project module. This announcement covers the following two issues: 1. Project release enables file attachments to create a specific version of cod...
FreeBSD Ports: postgresql-contrib
The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...
FreeBSD Ports: postgresql-contrib
The remote host is missing an update to the system as announced in the referenced advisory. VID 6a164d84-2f7f-11d9-a9e7-0001020eed82 OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...
SA-2008-023 - Ubercart - Cross site scripting
During checkout in Ubercart enabled stores, customers have text fields in which to enter their address and order information. Some stores will have modules enabled that restrict what sort of values are accepted in these fields, but this is not the case for everyone. This provides an opportunity f...
CentOS 3 : postgresql (CESA-2008:0039)
Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. PostgreSQL is an advanced Object-Relational database management system DBMS. The...
Fedora Core 6 : quagga-0.99.7-1.fc6 (2007-525)
This update contains rebase to quagga-0.99.7 along with fix for CVE-2007-1995. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...
Ubuntu 4.10 : postgresql contributed script vulnerability (USN-6-1)
Recently, Trustix Secure Linux discovered a vulnerability in the postgresql-contrib package. The script 'makeoidjoinscheck' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the script. Note...
PostgreSQL: Multiple vulnerabilities
Background PostgreSQL is a SQL compliant, open source object-relational database management system. Description PostgreSQL gives public EXECUTE access to a number of character conversion routines, but doesn't validate the given arguments CAN-2005-1409. It has also been reported that the...
PostgreSQL < 8.0.3 Multiple Vulnerabilities
According to its banner, the version of PostgreSQL installed on the remote host may suffer from the following vulnerabilities : - Character Conversion Vulnerability Unprivileged users can call functions supporting client- server character set conversion from SQL commands even though those functio...
Vulnerability in contrib module (CVE-2005-1410)
The tsearch2 contrib module declares several functions as internal even though they don't take an internal argument. This allows attackers to cause a denial of service and may possibly have other impacts. A valid login is required to exploit this vulnerability.Note! See the announcement for speci...
Vulnerability in contrib module (CVE-2005-0246)
The intagg contrib module allows attackers to cause a denial of service. A valid login is required to exploit this vulnerability...
FreeBSD : postgresql-contrib -- insecure temporary file creation (153)
The following package needs to be updated: postgresql-contrib %NASLMINLEVEL 999999 @DEPRECATED@ This script has been deprecated by freebsdpkg6a164d842f7f11d9a9e70001020eed82.nasl. Disabled on 2011/10/02. C Tenable Network Security, Inc. This script contains information extracted from VuXML :...