RHEL 5 : gtk2 (RHSA-2013:0135)

Updated gtk2 packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

CVE-2012-4477

Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors...

CVE-2012-4478

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

Sql injection

SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2012-4478

The CVE-2012-4478 vulnerability is a CSRF flaw in Drupal’s Drag & Drop Gallery 6.x module that can enable remote attackers to hijack an administrator’s session. Affected component: Drag & Drop Gallery module (Drupal contrib) 6.x. Root cause: CSRF in the module’s handling of admin actions, allowin...

CVE-2012-4477

Affected software: Drupal Drag & Drop Gallery module (6.x). Vulnerability type: Access bypass in the module’s handling of uploads and access controls (CVE-2012-4477). Root cause: unresolved access-control flaws in the Drag & Drop Gallery code path that can allow remote attackers to bypass restric...

CVE-2012-4478

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

CVE-2012-4476: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4477: Undefined Security Weakness

Unspecified vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to bypass access restrictions via unknown attack vectors...

CVE-2012-4478: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to hijack the authentication of administrators...

CVE-2012-4472: Undefined Security Weakness

Unrestricted file upload vulnerability in upload.php in the Drag & Drop Gallery module 6.x-1.5 and earlier for Drupal allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the...

CVE-2012-4479: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Drag & Drop Gallery module 6.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

New Dead drop techniques used by Security Agencies

Paul F Renda give an overview that, What and how new long distance and short distance Dead drop techniques are used by National Security Agency for secure communications. What is a dead drop? It is methods that spies use or have used to communicate with associates who have information for them. T...

cPanel Pro 11.32.5.11 Cross Site Request Forgery

============================================================================== Vulnerable Software: cPanel version : 11.32.5 build 11-11.32.5.11 cPanel Pro Vulnerability: CSRF Vendor: cpanel.net ==============================================================================...

CVE-2012-4403

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response...

CVE-2012-4403

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response...

Design/Logic Flaw

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response...

CVE-2012-4403

theme/yuicombo.php in Moodle 2.3.x before 2.3.2 does not properly construct error responses for the drag-and-drop script, which allows remote attackers to obtain the installation path by sending a request for a nonexistent resource and then reading the response...

CVE-2012-4403

Moodle 2.3.x before 2.3.2 is affected by CVE-2012-4403 due to improper construction of error responses in theme/yui_combo.php for the drag‑and‑drop script. This allows an unauthenticated remote attacker to discover the installation path by requesting a nonexistent resource and reading the respons...