42 matches found
NETGEAR ProSAFE Network Management System MibController realName Directory Traversal Denial-of-Service Vulnerability
This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within th...
CVE-2018-19469
ArticleCMS through 2017-02-19 has XSS via the /updatepersonalinfomation realname or email parameter...
CVE-2018-19469
ArticleCMS through 2017-02-19 has XSS via the /updatepersonalinfomation realname or email parameter...
SQL Injection Vulnerability in the realName Parameter of the /www/index.php Page of Pleasant Reading Media's Digital Newspaper System
Joy Reading Kiosk Digital Newspaper System is a digital newspaper WEB management system. There is a SQL injection vulnerability in this product, the vulnerability URL is:/www/index.php?mod=admin&con=user&realName=, the vulnerability parameter is: realName, the attacker can use the vulnerability t...
CVE-2016-1525
Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a .. dot dot in the realName parameter...
Netgear Management System NMS300 Directory Traversal Vulnerability
The Netgear Management System NMS300 is a network management system for diagnosing, controlling and optimizing network devices. A directory traversal vulnerability in the Netgear Management System NMS300's handling of the 'realName' parameter allows remote attackers to obtain arbitrary system fil...
SA-CONTRIB-2014-051 - Realname Registration - Information Disclosure
This module enables you to generate usernames based on fields filled out by the user during registration. The module doesn't sufficiently restrict access to the settings for determining which user fields are incorporated into usernames, and doesn't properly validate generated user names. Any user...
CVE-2012-2298
Multiple cross-site scripting XSS vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 "user names in page titles" and 2 "autocomplete callbacks."...
CVE-2012-2298
Multiple cross-site scripting XSS vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 "user names in page titles" and 2 "autocomplete callbacks."...
CVE-2012-2298
The CVE-2012-2298 issue concerns vulnerabilities in the Drupal RealName module (6.x-1.x) prior to 6.x-1.5. The root cause is inadequate escaping of user-provided data, enabling remote attackers to inject arbitrary script/HTML via two vectors: (1) user names in page titles and (2) autocomplete cal...
SA-CONTRIB-2012-104 - Privatemsg - Cross Site Scripting (XSS)
The Privatemsg module allows users to send private messages between to each other. The module doesn't sufficiently sanitize user names when creating messages. This vulnerability is mitigated by the fact that it is not possible to create insecure user names through the default user interface. The...
SA-CONTRIB-2012-063 - RealName - Cross Site Scripting (XSS)
CVE: CVE-2012-2298 This module allows you to set a pattern for constructing "Real names" for users out of profile fields. The module does not sufficiently escape users' real names under certain circumstances which could lead to a Cross-Site Scripting XSS attack. Versions affected RealName 6.x-1.x...
CVE-2012-2156
Multiple cross-site scripting XSS vulnerabilities in Plume CMS 1.2.4 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the uemail parameter aka Authors Email field to manager/users.php, 2 the urealname parameter aka Authors Name field to manager/users.php, or 3 the...
Drupal's <= v6.x-1.0 Realname User Reference Widget contributed module
Exploit for unknown platform in category web applications ====================================================================== Drupal's Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easily...
Drupal Realname User Reference Information Disclosure
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easil...
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module (version 6.x-1.0)
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella [email protected] Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a...
Cross site scripting
Cross-site scripting XSS vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname aka real name element...
CVE-2009-4524
Cross-site scripting XSS vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname aka real name element...
CVE-2009-4524
Cross-site scripting XSS vulnerability in the RealName module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via a realname aka real name element...
CVE-2009-4524
CVE-2009-4524 affects the Drupal RealName module (6.x-1.x) prior to 6.x-1.3. It is a Cross-site Scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via the realname element. The entry lists a MEDIUM impact with a base score of 4.3 (NVD), but exploitat...