SA-CONTRIB-2009-032 - Webform - Cross-site scripting

The Webform module provides a node type which is typically used to enable site visitors to fill in questionnaires, contact or request/registration forms, surveys, polls, or other forms on a Drupal site. When displaying the results of Webform submissions, the module does not properly filter user...

SA-CONTRIB-2009-033 - Quiz - Cross site scripting

The Quiz module provides tools for authoring and administering quizzes through Drupal. A quiz is given as a series of questions, with only one question appearing per page. Scores are then stored in the database. The module does not properly escape user-supplied data on some pages, allowing...

ZaoCMS File Disclosure

-------------------------------------------------------------- ZaoCMS Remote File Disclosure Vulnerability --------------------------------------------------------------- Founder :ThE g0bL!N Home:http://www.zaocms.com/ Software : ZaoCMS Note: The OperatIon Worked By Deleting Your Cookies From The...

ZaoCMS (download.php) Remote File Disclosure Vulnerability

No description provided by source. -------------------------------------------------------------- ZaoCMS Remote File Disclosure Vulnerability --------------------------------------------------------------- Founder :ThE g0bL!N Home:http://www.zaocms.com/ Software : ZaoCMS Note: The OperatIon Worke...

Article Directory Blind SQL Injection

-------------------------------------------------------------- Article Directory page.php Remote Blind SQL Injection Exploit --------------------------------------------------------------- Founder :ThE g0bL!N Home:http://www.yourarticlesdirectory.com Software : Article Directory Thank You Very Mu...

Article Directory (page.php) Remote Blind SQL Injection Vulnerability

No description provided by source. -------------------------------------------------------------- Article Directory page.php Remote Blind SQL Injection Exploit --------------------------------------------------------------- Founder :ThE g0bL!N Home:http://www.yourarticlesdirectory.com Software :...

Article Directory - page.php Blind SQL Injection

Article Directory - page.php Blind SQL Injection -------------------------------------------------------------- Article Directory page.php Remote Blind SQL Injection Exploit --------------------------------------------------------------- Founder :ThE g0bL!N Home:http://www.yourarticlesdirectory.c...

ZaoCMS - 'download.php' Remote File Disclosure

-------------------------------------------------------------- ZaoCMS Remote File Disclosure Vulnerability --------------------------------------------------------------- Founder :ThE g0bL!N Home:http://www.zaocms.com/ Software : ZaoCMS Note: The OperatIon Worked By Deleting Your Cookies From The...

ZaoCMS - Insecure Cookie Handling

-------------------------------------------------------------- ZaoCMS Insecure Cookie Handling Vulnerability --------------------------------------------------------------- Founder :ThE g0bL!N Home:http://www.zaocms.com/ Software : ZaoCMS...

SA-CONTRIB-2009-030 - Email Verification - Information disclosure / Cross Site Scripting

The Email Verification module tries to verify user email addresses by talking to the appropriate SMTP host. It also allows the administrator to access a list of not confirmed email addresses. In the Drupal 5 version, this list is only protected by the "access content" permission, hence allowing a...

SA-CONTRIB-2009-028 - Feed Block - Cross Site Scripting

The Feed Block module creates a block with one externalsyndicated article for each feed source from selected feed category. Feed block doesn't properly escapes aggregator items allowing users with administer news feeds permission to inject arbitrary code into the site. Such a cross site scripting...

SA-CONTRIB-2009-026 - LoginToboggan - Access bypass

LoginToboggan includes a setting which, if enabled, allows users to log in using either their username or e-mail address. In some circumstances, previously blocked users may still be able to access the site if this setting is enabled. Versions affected LoginToboggan 6.x-1.x prior to 6.x-1.5...

SA-CORE-2009-006 - Drupal core - Cross site scripting

When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input. Certain byte sequences that are valid in the UTF-...

drupal -- cross-site scripting

The Drupal Security Team reports: When outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input. Certain byte...

RedHat Security Advisory RHSA-2009:0457

The remote host is missing updates announced in advisory RHSA-2009:0457. libwmf is a library for reading and converting Windows Metafile Format WMF vector graphics. libwmf is used by applications such as GIMP and ImageMagick. A pointer use-after-free flaw was found in the GD graphics library...

Twitter needs a top-down security rethink

Twitter co-founder Biz Stone says the company “takes security very seriously” but the details behind the micro-blogging site’s recent hack shows that Twitter is light years away from having the most basic security controls in place. French hacker gains access to Twitter’s admin panel Here’s the...

Moderate: Red Hat Security Advisory: libwmf security update

Updated libwmf packages that fix one security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. libwmf is a library for reading and converting Windows Metafile Format WMF vector...

MataChat Cross Site Scripting

a bug in MataChat that allows to us to occur a Cross-Site Scripting on a Remote machin. this bug tested with the Vulnerable Software All Ver. -------------------------------------------------- Islamic Republic Of Iran Security Team Www.IrIsT.Ir MataChat == All Version Cross-Site Scripting...

MataChat Cross-Site Scripting Vulnerabilities

a bug in MataChat that allows to us to occur a Cross-Site Scripting on a Remote machin. this bug tested with the Vulnerable Software All Ver. -------------------------------------------------- Islamic Republic Of Iran Security Team Www.IrIsT.Ir MataChat == All Version Cross-Site Scripting...

Mandriva Linux Security Advisory : postfix (MDVSA-2008:171)

Sebastian Krahmer of the SUSE Security Team discovered a flaw in the way Postfix dereferenced symbolic links. If a local user had write access to a mail spool directory without a root mailbox file, it could be possible for them to append arbitrary data to files that root had write permissions to...