EUVD-2012-4931

Malware in sbrugna...

EUVD-2014-0031

Malware in sbrugna...

EUVD-2012-1635

Malware in sbrugna...

CVE-2012-5007

The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdfmergepdf function and incorrect arguments, a different vulnerability than CVE-2012-1625. NOTE: some of these details are obtained from third...

CVE-2012-1625

Eval injection vulnerability in the fillpdfformexportdecode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors...

DEBIAN-CVE-2014-1838

The 1 extractkeysfrompdf and 2 fillpdf functions in pdfext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf...

CVE-2012-1625

Eval injection vulnerability in the fillpdfformexportdecode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors...

CVE-2012-5007

The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdfmergepdf function and incorrect arguments, a different vulnerability than CVE-2012-1625. NOTE: some of these details are obtained from third...

Design/Logic Flaw

The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdfmergepdf function and incorrect arguments, a different vulnerability than CVE-2012-1625. NOTE: some of these details are obtained from third...

Sql injection

Eval injection vulnerability in the fillpdfformexportdecode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors...

CVE-2012-5007

The CVE-2012-5007 entry concerns the Drupal Fill PDF module (7.x-1.x before 7.x-1.2; also 6.x-1.x paths in related CVEs). Affected component/function: fillpdf_merge_pdf, with unspecified vectors and incorrect arguments that allow remote attackers to write to arbitrary PDF files. The root cause an...

CVE-2012-5007

The Fill PDF module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to write to arbitrary PDF files via unspecified vectors related to the fillpdfmergepdf function and incorrect arguments, a different vulnerability than CVE-2012-1625. NOTE: some of these details are obtained from third...

CVE-2012-1625

The CVE-2012-1625 issue affects the Drupal Fill PDF module (6.x-1.x before 6.x-1.16; 7.x-1.x before 7.x-1.2). The root cause is an eval injection in fillpdf_form_export_decode within fillpdf.admin.inc, allowing remote authenticated users with administer PDFs privileges to execute arbitrary PHP co...

Drupal Fill PDF模块安全绕过和任意代码执行漏洞

Bugtraq ID: 51288 Drupal是一款开放源码的内容管理平台。 Drupal Fill PDF模块存在安全漏洞，允许恶意用户控制应用系统或绕过部分安全限制。 -在fillpdf.module中的"fillpdfmergepdf"函数中由于缺失参数错误，可被利用通过构建特制WEB请求绕过验证机制。 -通过导入模版传递的输入在用于"eval"调用之前在fillpdf.admin.inc中的"fillpdfformexportdecode"函数里缺少正确过滤，可被利用执行任意PHP代码。 要成功利用漏洞需要"administer PDFs"权限。 0 Drupal Fill P...

SA-CONTRIB-2012-003 - Fill PDF - Multiple vulnerabilities

CVE: CVE-2012-1625 This module enables you to populate fillable PDF templates with data from nodes and webforms. Access bypass 7.x only Incorrectly-ordered arguments in a call to the function that handles the main functionality of the module makes it possible for an attacker to trigger any PDF to...