CVE-2013-7061

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

Authentication flaw

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

CVE-2013-7061: Undefined Security Weakness

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

Ektron CMS SQL注入漏洞

Ektron CMS是一款内容管理系统。 由于关于Ektron Search API的输入在用于SQL查询时缺少过滤，可导致SQL注入攻击。 0 Ektron CMS 8.x Ektron CMS 9.00版本已修复该漏洞，建议用户下载使用： http://www.ektron.com/...

CVE-2013-4662

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...

Sql injection

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...

CVE-2013-4662

The CVE-2013-4662 entry describes a SQL injection vulnerability in CiviCRM’s Quick Search API (contact.getquick) affecting CiviCRM versions 4.2.0–4.2.9 and 4.3.0–4.3.3. The issue allows remote authenticated users to bypass the validation layer and perform SQL injection via a direct request to the...

CVE-2013-4662: Improper Neutralization of Special Elements used in an SQL Command

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...

CVE-2013-2715

Cross-site scripting XSS vulnerability in the admin view in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name...

CVE-2013-0181

Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

CVE-2013-0181

Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in the admin view in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name...

CVE-2013-2715

Cross-site scripting XSS vulnerability in the admin view in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name...

CVE-2013-2715

CVE-2013-2715 describes a Cross-site scripting (XSS) vulnerability in Drupal’s admin view of the Search API (search_api) module, affecting the 7.x-1.x line prior to 7.x-1.4 . The issue allows remote authenticated users with certain permissions to inject arbitrary web script/HTML via a crafted fie...

CVE-2013-0181

Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

CVE-2013-0181

The CVE-2013-0181 issue is a Cross-site scripting (XSS) vulnerability in the Drupal Search API module (7.x-1.x) for Drupal 7.x, caused by insufficient sanitization of input in error messages surfaced when using certain backends and facets. Affected component is the Views integration within Search...

CVE-2013-0181: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...

Cross site scripting

Cross-site scripting XSS vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels...

CVE-2013-0227

The CVE-2013-0227 entry involves Drupal's Search API Sorts module (7.x-1.x) with a XSS vulnerability caused by insufficient filtering of user-entered text in field labels. Affects Drupal 7.x, versions prior to 7.x-1.4. Impact: remote authenticated users with certain roles can inject arbitrary Jav...