UBUNTU-CVE-2014-5022

Cross-site scripting XSS vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field...

CVE-2014-5022

Cross-site scripting XSS vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field...

CVE-2014-5020

The Drupal 7.x File module vulnerability CVE-2014-5020 allows remote authenticated users with certain permissions to bypass file-view restrictions and read files by attaching a file to content via a file field. Affected software: Drupal core (Drupal 7.x) prior to 7.29. Root cause: improper permis...

CVE-2014-5020

The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field...

CVE-2014-5022

Removed by vendor...

PT-2014-6254

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.29 Description A cross-site scripting XSS issue exists in the Ajax system, allowing remote attackers to inject arbitrary web script or HTML. This is achieved through vectors involving forms with an Ajax-enabled...

CVE-2014-5020: Undefined Security Weakness

The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field...

Format string

Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service crash or possibly execute arbitrary code via format string specifiers in the Remote File field...

CVE-2013-6809: Use of Externally-Controlled Format String

Format string vulnerability in the client in Tftpd32 before 4.50 allows remote servers to cause a denial of service crash or possibly execute arbitrary code via format string specifiers in the Remote File field...

Authorization

file/edithtml.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field...

CVE-2012-2983

file/edithtml.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field...

PT-2011-3957

Name of the Vulnerable Software and Affected Versions HP OpenView Performance Agent versions 4.70 and 5.0 HP Operations Agent versions 8.53, 8.60.005, 8.60.006, 8.60.007, 8.60.008, 8.60.501, and 11.0 ovbbccb.exe version 6.20.50.0 Description The issue allows remote attackers to delete arbitrary...

Prestashop Cartium 1.3.3 Cross Site Scripting

Hello, In Prestashop Cartium 1.3.3 I have detected multiple Cross Site Scripting XSS vulnerabilities: File Field categoty.php idcategory product.php idproduct search.php searchquery Test pattern for vulnerable versions: "alert1 Kind Regards Antonio San Martino...

PT-2009-6010 · Drupal · Filefield

Name of the Vulnerable Software and Affected Versions: FileField versions 6.x-3.1 Description: The issue concerns the filefield file download function, which does not properly check node-access permissions for Drupal core private files. This allows remote attackers to access unauthorized files vi...

CVE-2006-0564: Undefined Security Weakness

Stack-based buffer overflow in Microsoft HTML Help Workshop 4.74.8702.0, and possibly earlier versions, and as included in the Microsoft HTML Help 1.4 SDK, allows context-dependent attackers to execute arbitrary code via a .hhp file with a long Contents file field...