317 matches found
CVE-2013-4662
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...
CVE-2013-4662: Improper Neutralization of Special Elements used in an SQL Command
The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick...
PT-2014-2848
Name of the Vulnerable Software and Affected Versions CiviCRM versions 4.2.0 through 4.2.9 CiviCRM versions 4.3.0 through 4.3.3 Description The issue allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of th...
CVE-2013-2715
Cross-site scripting XSS vulnerability in the admin view in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name...
CVE-2013-0181
Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...
CVE-2013-0181
Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...
Cross site scripting
Cross-site scripting XSS vulnerability in the admin view in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name...
Cross site scripting
Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...
CVE-2013-2715
Cross-site scripting XSS vulnerability in the admin view in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a crafted field name...
CVE-2013-0181
Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...
CVE-2013-0181
The CVE-2013-0181 issue is a Cross-site scripting (XSS) vulnerability in the Drupal Search API module (7.x-1.x) for Drupal 7.x, caused by insufficient sanitization of input in error messages surfaced when using certain backends and facets. Affected component is the Views integration within Search...
CVE-2013-2715
CVE-2013-2715 describes a Cross-site scripting (XSS) vulnerability in Drupal’s admin view of the Search API (search_api) module, affecting the 7.x-1.x line prior to 7.x-1.4 . The issue allows remote authenticated users with certain permissions to inject arbitrary web script/HTML via a crafted fie...
PT-2013-2148
Name of the Vulnerable Software and Affected Versions Drupal search api module versions 7.x-1.x before 7.x-1.4 Description A cross-site scripting XSS issue exists in the Search API module for Drupal. This occurs when using certain backends and facets, allowing remote attackers to inject arbitrary...
PT-2013-3884
Name of the Vulnerable Software and Affected Versions Drupal search api module versions 7.x-1.x before 7.x-1.4 Description A cross-site scripting XSS issue exists in the admin view of the Search API module, allowing remote authenticated users with specific permissions to inject arbitrary web scri...
CVE-2013-0181: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Views in the Search API searchapi module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message...
Cross site scripting
Cross-site scripting XSS vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels...
CVE-2013-0227
Cross-site scripting XSS vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels...
CVE-2013-0227
Cross-site scripting XSS vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels...
CVE-2013-0227
The CVE-2013-0227 entry involves Drupal's Search API Sorts module (7.x-1.x) with a XSS vulnerability caused by insufficient filtering of user-entered text in field labels. Affects Drupal 7.x, versions prior to 7.x-1.4. Impact: remote authenticated users with certain roles can inject arbitrary Jav...
PT-2013-2170
Name of the Vulnerable Software and Affected Versions Drupal Search API Sorts module versions 7.x-1.x before 7.x-1.4 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels in t...