Search API Solr - Moderately critical - Access bypass - SA-CONTRIB-2018-065

This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently take the searched fulltext fields into account when creating a search excerpt. This can, in specific cases, lead to confidential data being leak...

reedriver.com XSS vulnerability

Open Bug Bounty ID: OBB-566576 Description| Value ---|--- Affected Website:| reedriver.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

HTML Injection

github.com/gogits/gogs is vulnerable to HTML injection. The user search API can be used to inject HTML content. An attacker could insert spoofed content to carry out some form of social engineering attack. HTML injection is an attack that is similar to cross-site scripting but does not execute...

Downloading entire Vulners.com database in 5 minutes

Today I once again would like to talk about Vulners.com and why, in my opinion, it is the best vulnerability database that exist nowadays and a real game-changer. The main thing is transparency. Using Vulners you not only can search for security content see "Vulners – Google for hacker", but...

Drupal Search API Sorts Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.The Search API Sorts module is one of the modules that provides custom sorting and global sort blocks for the Search API. A cross-site scripting vulnerability exists in the Drupal Searc...

Search API Sorts - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-016

The Search API Sorts module allows the site administrator to configure custom sort options for their search results and expose the control interface via the core block system. The module doesn't sufficiently sanitise the name of the sort option which is displayed to users. This vulnerability is...

Multiple vulnerabilities in the Drupal Search API module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search API is one of the framework modules used to create search functionality for any Entity of Drupal. Information disclosure vulnerabilities, cross-site scripting vulnerabilities, an...

Search API - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-022

This module enables you to build searches using a wide range of features, data sources and backends. Search index not updated by node access changes The module doesn't sufficiently re-index nodes when using the "Node access" or "Access check" data alterations and non-standard ways of changing nod...

CVE-2015-6752

Cross-site scripting XSS vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified...

Cross site scripting

Cross-site scripting XSS vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified...

CVE-2015-6752

Summary: CVE-2015-6752 is a cross-site scripting (XSS) vulnerability in Drupal’s Search API Autocomplete module (7.x-1.x, prior to 7.x-1.3). The issue arises when the search index uses the HTML filter processor, allowing remote authenticated users with certain permissions to inject arbitrary web ...

Drupal Search API Autocomplete Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search API Autocomplete is one of the modules used to add autocomplete functionality to search fields during searches and provide a list of suggestions. A cross-site scripting...

Search API Autocomplete - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-140

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module doesn't sufficiently sanitize the HTML output for the returned suggestions, theoretically allowing an attacker to include custom HTML there. This vulnerability is mitigated by t...

IBM Business Process Manager Search REST API Access Bypass Vulnerability

IBM Business Process Manager is a comprehensive BPM platform that integrates WebSphere Lombardi, the industry's leading human-centric business process management platform, and WPS, a business process management platform centered on SOA integration. A security vulnerability exists in IBM BPM's...

elasticsearch: remote code execution flaw via dynamic scripting

It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...

CVE-2013-7061

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

Authentication flaw

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

Ektron CMS SQL注入漏洞

Ektron CMS是一款内容管理系统。 由于关于Ektron Search API的输入在用于SQL查询时缺少过滤，可导致SQL注入攻击。 0 Ektron CMS 8.x Ektron CMS 9.00版本已修复该漏洞，建议用户下载使用： http://www.ektron.com/...

CVE-2013-4662

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...

Sql injection

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...