3090 matches found
CVE-2008-3221
Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...
CVE-2008-3221
Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...
CVE-2008-3218
Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...
CVE-2008-3221
Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...
CVE-2008-3218
Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...
CVE-2008-3221
CVE-2008-3221 is a Drupal CSRF vulnerability affecting Drupal 6.x prior to 6.3, allowing remote attackers to perform administrative actions via deletion of OpenID identities. The issue stems from cross-site request forgery in forms that enables unauthorized admin operations. Connected advisories ...
CVE-2008-3218
CVE-2008-3218 affects Drupal 6.x before 6.3, with XSS via free-tagging taxonomy terms on node previews and unspecified OpenID values. Remote attackers can inject arbitrary script/HTML. Connected advisories indicate remediation by upgrading to Drupal 6.4 (and related updates); no exploitation deta...
CVE-2008-3221: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...
CVE-2008-3218: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...
FreeBSD : drupal -- multiple vulnerabilities (ecedde1c-5128-11dd-a4e1-0030843d3802)
The Drupal Project reports : Free tagging taxonomy terms can be used to insert arbitrary script and HTML code cross site scripting or XSS on node preview pages. A successful exploit requires that the victim selects a term containing script code and chooses to preview the node. This issue affects...
SA-2008-045 - OpenID - Multiple vulnerabilities
The OpenID module for Drupal 5.x allows uses to create an account or log into a Drupal site using one or more OpenID identities. Find out more about OpenID at http://openid.net. Two vulnerabilities and weaknesses were discovered in the contributed OpenID module. Cross site scripting Some...
ikiwiki空口令绕过认证漏洞
BUGTRAQ ID: 29479 CVECAN ID: CVE-2008-0169 Ikiwiki是一个wiki编译器，可将wiki页面转换为可在网站发布的HTML页面。 Ikiwiki在处理访问认证时存在漏洞，如果在Ikiwiki中启用了openid和passwordauth插件的话（默认配置），用户就可以通过带有空口令的登录请求绕过认证限制登录，访问openid相关帐号。 ikiwiki ikiwiki 2.48 ikiwiki ikiwiki 1.34 ikiwiki ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...
CVE-2008-0169
Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...
CVE-2008-0169
Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...
Authentication flaw
Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...
CVE-2008-0169
Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...
CVE-2008-0169
Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...
CVE-2008-0169: Undefined Security Weakness
Plugin/passwordauth.pm aka the passwordauth plugin in ikiwiki 1.34 through 2.47 allows remote attackers to bypass authentication, and login to any account for which an OpenID identity is configured and a password is not configured, by specifying an empty password during the login sequence...