SA-CONTRIB-2009-095 - Smartqueue OG - Access Bypass

The Smartqueueog module uses Nodequeue's Smartqueue API to provide a Nodequeue for organic groups which is editable by members of that group or the group's administrators. Users with the "administer nodequeue" permission have the option to batch create subqueues individual instances of a queue fo...

CVE-2009-3786

CVE-2009-3786 affects Drupal’s Organic Groups (OG) Vocabulary module. Vulnerable: OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1. Issue: cross-site scripting via the group title, enabling remote injection of arbitrary web script/HTML. Impact as stated: script execution in user context; n...

CVE-2009-3786: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Organic Groups OG Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title...

SA-CONTRIB-2009-075 - OG Vocabulary 5.x

The Organic Groups Vocabulary module enables an organic group to have a group specific vocabulary. In some specific cases, the module does not sanitize before outputting the group title, resulting in a cross-site scripting XSS vulnerability. Such an attack may lead to a malicious user gaining ful...

CVE-2008-3095

The CVE-2008-3095 entry concerns the Organic Groups (OG) module for Drupal. A cross-site scripting (XSS) vulnerability affects OG 5.x before 5.x-7.3 and 6.x before 6.x-1.0-RC1, allowing remote authenticated users with group owner permissions to inject arbitrary web script or HTML via unspecified ...

CVE-2008-3094

The CVE affects the Drupal Organic Groups (OG) module, specifically 5.x prior to 5.x-7.3 and 6.x prior to 6.x-1.0-RC1. The vulnerability enables remote attackers to disclose sensitive information (private group names) via unspecified vectors. The description does not detail a fixed patch or remed...

ContentNow Directory Traversal(upload.php)

ContentNow Directory Traversalupload.php ------------------------------------------ -vulnerability By: Timq -http://securitydb.org -Team Root-Shell -Email:timqathushmail.com ------------------------------------------ It appears that it is possible to view any files on a system via 'upload.php'...