SA-CONTRIB-2015-035 - Ajax Timeline - Cross Site Scripting (XSS)

Ajax Timeline module enables you to display a vertical timeline of nodes based off a date field or created date of the configured nodes. The module doesn't sufficiently escape node titles when displaying the timeline, allowing a malicious user to inject code. This vulnerability is mitigated by th...

SA-CONTRIB-2015-038 - Facebook Album Fetcher - Cross Site Scripting (XSS) - Unsupported

Facebook Album Fetcher module allows you to fetch Facebook albums from a Facebook account. The module incorrectly prints fields without proper sanitization thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Fedora 20 : clamav-0.98.6-1.fc20 (2015-1437)

ClamAV 0.98.6 ============= ClamAV 0.98.6 is a bug fix release correcting the following : - library shared object revisions. - installation issues on some Mac OS X and FreeBSD platforms. - includes a patch from Sebastian Andrzej Siewior making ClamAV pid files compatible with systemd. - Fix a hea...

Remote let the phone restart count as vulnerability? At least Google says not to count-vulnerability warning-the black bar safety net

Security researchers recently announced about the Android WiFi-Direct vulnerabilities, the vulnerability can lead to Android device reboot. Google and the vulnerability is found above the Core Security of the company has been in debate about this Android vulnerability severity--in the end let the...

ManageEngine Firewall Analyzer 8.0 - Directory Traversal Cross-Site Scripting

ManageEngine Firewall Analyzer 8.0 - Directory Traversal Cross-Site Scripting ...:::::ManageEngine Firewall Analyzer Directory Traversal/XSS Vulnerabilities::::.... Sobhan System Network & Security Group sobhansys ------------------------------------------------------- Date: 2015-01-28 Exploit...

ManageEngine Firewall Analyzer 8.0 - Directory Traversal/XSS Vulnerabilities

Exploit for hardware platform in category web applications ...:::::ManageEngine Firewall Analyzer Directory Traversal/XSS Vulnerabilities::::.... Sobhan System Network & Security Group sobhansys ------------------------------------------------------- Date: 2015-01-28 Exploit Author: AmirHadi...

SA-CONTRIB-2015-030 - Amazon AWS - Access bypass

Amazon AWS module provides integration with Amazon Web Services AWS. A malicious user could potentially guess an access token and trigger the creation of new backups by making a request to a specially-crafted URL. If the number of stored backups was limited, an attacker could exceed the limit by...

SA-CONTRIB-2015-031 - GD Infinite Scroll - Multiple vulnerabilites

GD Infinite Scroll module enables you to use the "infinite scroll jQuery plugin : auto-pager" on custom pages. Some links were not protected against CSRF. A malicious user could cause another user with the "edit gd infinite scroll settings" permission to delete settings by getting his browser to...

SA-CONTRIB-2015-033 - Certify - Access bypass and information disclosure

Certify enables you to automatically issue PDF certificates to users upon completion of a set of conditions. The module does not sufficiently check node access when showing and creating the PDF certificates. This can lead to users seeing certificates they should not have access to. This...

Marriott Fixes Simple Bug in Web Service That Could Explose Customer Data

Customer payment information and other data was made vulnerable by a flaw in the Marriott Web service used by the Android app as well as the Web site, a security researcher found. The vulnerability is the result of Marriott’s system failing to use any kind of authentication on requests, meaning...

Mangallam CMS - SQL Injection

Document Title: =============== Mangallam CMS - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1421 Release Date: ============= 2015-01-26 Vulnerability Laboratory ID VL-ID: ==================================== 1421 Commo...

Mangallam CMS - SQL Injection Web Vulnerability

Document Title: =============== Mangallam CMS - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1421 Release Date: ============= 2015-01-26 Vulnerability Laboratory ID VL-ID: ==================================== 1421 Commo...

CVE-2014-7928

hydrogen.cc in Google V8, as used Google Chrome before 40.0.2214.91, does not properly handle arrays with holes, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via crafted JavaScript code that triggers an array copy...

CVE-2015-1346

Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via unknown vectors...

SA-CONTRIB-2015-026 - Taxonews - Cross Site Scripting (XSS)

This module enables you to create blocks of nodes carrying a given taxonomy term. The module doesn't sufficiently escape term names in the blocks it builds leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

SA-CONTRIB-2015-025 - Patterns - Cross Site Request Forgery (CSRF)

Patterns module manages and automates site configuration. Site configurations stored in XML or YAML are called Patterns, and these are easy to read, modify, manage & share and can be executed manually or as a part of an automated web site deployment. Some links were not protected against CSRF. A...

Sites Powered By INVEM SQL Injection

+++++++++++++++++++++++++++++++++ + +Exploit Title : Invem CMS SQL INJECTION Vulnerability + +Exploit Author : Ashiyane Digital Security Team + +Vendor Homepage: http://www.invem.com/ + +Google Dork : intext:Powered by INVEM. + +Date : 20 / Jan / 2015 + +Tested On : windows se7en + linux Kali +...

Blitz CMS Community - SQL Injection Web Vulnerability

Document Title: =============== Blitz CMS Community - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1403 Release Date: ============= 2015-01-12 Vulnerability Laboratory ID VL-ID: ==================================== 1402...

SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported

This module displays node author information in a jQuery slider. The module doesn't sufficiently sanitize Profile2 fields in a provided block. This vulnerability is mitigated by the fact that an attacker must have a user account allowed to edit profile fields. CVE identifiers issued CVE-2015-3365...

Blitz CMS SQL Injection

Document Title: =============== Blitz CMS Community - SQL Injection Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1403 Release Date: ============= 2015-01-12 Vulnerability Laboratory ID VL-ID: ==================================== 1402...