Multiple vulnerabilities in the Drupal Search API module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search API is one of the framework modules used to create search functionality for any Entity of Drupal. Information disclosure vulnerabilities, cross-site scripting vulnerabilities, an...

Search API - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-022

This module enables you to build searches using a wide range of features, data sources and backends. Search index not updated by node access changes The module doesn't sufficiently re-index nodes when using the "Node access" or "Access check" data alterations and non-standard ways of changing nod...

CVE-2015-6752

Cross-site scripting XSS vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified...

Cross site scripting

Cross-site scripting XSS vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified...

CVE-2015-6752

Summary: CVE-2015-6752 is a cross-site scripting (XSS) vulnerability in Drupal’s Search API Autocomplete module (7.x-1.x, prior to 7.x-1.3). The issue arises when the search index uses the HTML filter processor, allowing remote authenticated users with certain permissions to inject arbitrary web ...

PT-2015-7336

Name of the Vulnerable Software and Affected Versions Drupal Search API Autocomplete module versions 7.x-1.x before 7.x-1.3 Description A cross-site scripting XSS issue exists in the Search API Autocomplete module for Drupal. This occurs when the search index is configured to use the HTML filter...

CVE-2015-6752: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified...

Drupal Search API Autocomplete Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search API Autocomplete is one of the modules used to add autocomplete functionality to search fields during searches and provide a list of suggestions. A cross-site scripting...

Search API Autocomplete - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-140

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module doesn't sufficiently sanitize the HTML output for the returned suggestions, theoretically allowing an attacker to include custom HTML there. This vulnerability is mitigated by t...

IBM Business Process Manager Search REST API Access Bypass Vulnerability

IBM Business Process Manager is a comprehensive BPM platform that integrates WebSphere Lombardi, the industry's leading human-centric business process management platform, and WPS, a business process management platform centered on SOA integration. A security vulnerability exists in IBM BPM's...

PT-2015-5028

Name of the Vulnerable Software and Affected Versions Kiwix versions prior to 0.9.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the pattern parameter to the "/search" API endpoint. Recommendations For versions prior to 0.9.1,...

elasticsearch: remote code execution flaw via dynamic scripting

It was discovered that the default configuration of Elasticsearch enabled dynamic scripting, allowing a remote attacker to execute arbitrary MVEL expressions and Java code via the source parameter passed to search...

CVE-2013-7061

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

Authentication flaw

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

CVE-2013-7061

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

CVE-2013-7061: Undefined Security Weakness

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API...

Ektron CMS SQL注入漏洞

Ektron CMS是一款内容管理系统。 由于关于Ektron Search API的输入在用于SQL查询时缺少过滤，可导致SQL注入攻击。 0 Ektron CMS 8.x Ektron CMS 9.00版本已修复该漏洞，建议用户下载使用： http://www.ektron.com/...

CVE-2013-4662

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...

Sql injection

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...

CVE-2013-4662

The CVE-2013-4662 entry describes a SQL injection vulnerability in CiviCRM’s Quick Search API (contact.getquick) affecting CiviCRM versions 4.2.0–4.2.9 and 4.3.0–4.3.3. The issue allows remote authenticated users to bypass the validation layer and perform SQL injection via a direct request to the...