SchoolMation 2.3 - SQL Injection / Cross-Site Scripting

==================================================== SchoolMation Version 2.3 SQLi and XSS Vulnerability ==================================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, \ /\/\ \ \ \ \ ,/\ /\ \ 1 1 //...

RHEL 5 : openldap (RHSA-2010:0198)

Updated openldap packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

Cross site scripting

Cross-site scripting XSS vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page...

CVE-2010-1362

Cross-site scripting XSS vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page...

CVE-2010-1362

CVE-2010-1362 is an XSS vulnerability in the Drupal Own Term module 6.x-1.0. Remote authenticated users with "create additional terms" privileges can inject arbitrary script or HTML via the term description field on a term listing page. Impact is partial on integrity (XSS) with no confidentiality...

CVE-2010-1362

Cross-site scripting XSS vulnerability in the Own Term module 6.x-1.0 for Drupal allows remote authenticated users, with "create additional terms" privileges, to inject arbitrary web script or HTML via the term description field in a term listing page...

SA-CONTRIB-2010-005 - Own Term - Cross site scripting

The Own Term module allows users to create taxonomy terms in a designated vocabulary and when creating content this term is automatically added to the node. The module does not sanitize the term description on a term listing page which opens a cross-site scripting XSS attack. Users with a role...

Q&A: Eugene Spafford on Cybercrime, Security Research

Threatpost editor Dennis Fisher talks with Eugene Spafford of Purdue’s CERIAS center about cybercrime, funding for long-term security research projects and whether the federal cybersecurity coordinator position matters. Fisher: Do you see any indications that there will be more funding coming fro...

New Security Consortium to Focus on Long-Term Projects

The three universities involved in the security consortium put together this week by Northrop Grumman will have wide latitude to pursue research projects as they see fit and will be under no obligation to work only on technology that fits Northrop’s future plans. The researchers, in fact, will be...

Cross site scripting

Cross-site scripting XSS vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refinebytaxo when displaying tags...

Sql injection

Multiple SQL injection vulnerabilities in index.php in MIM:InfiniX 1.2.003 and possibly earlier versions allow remote attackers to execute arbitrary SQL commands via the 1 month and 2 year parameters in a calendar action, or 3 a search term in the search form...

PT-2009-4532 · Drupal · Drupal Taxonomy Manager

Name of the Vulnerable Software and Affected Versions: Drupal Taxonomy manager versions 5.x before 5.x-1.2 Drupal Taxonomy manager versions 6.x before 6.x-1.1 Description: A cross-site scripting XSS issue exists in the administrative page interface of the Taxonomy manager module for Drupal. This...

CVE-2009-0540

Libero CVE-2009-0540 is an XSS vulnerability in Libero 5.3 SP5 (and possibly versions before 5.5 SP1) that allows remote attackers to inject arbitrary web script via the search term field. The issue arises from insufficient input filtering/sanitisation of HTML tags in the web app, and is categori...

U.S. needs to investigate cyberweapons

Despite what you may have seen on 24 or read in Tom Clancy’s novels, the United States is well behind much of the rest of the world in developing both defensive and offensive cybersecurity capabilities, and that’s a deficit that may end up costing us dearly in the long run, according to a longtim...

Nokia DX200 Denial Of Service

Vulnerability: Nokia TCP Syn Flood DoS - DX200 Synopsis : Denial of Service Affected Platforms: DX200 M13 MGW/HLR, S12 BSC Severity: High Risk Vendor: Nokia http://www.nokia.com/ Exploit Release Date: 01/21/2009 By: tambarus [email protected] !/usr/bin/perl eval "use Getopt::Long;";die "error...

CVE-2008-5628

SQL injection vulnerability in index.php in CMS little 0.0.1 allows remote attackers to execute arbitrary SQL commands via the term parameter...

CVE-2008-3097

Cross-site scripting XSS vulnerability in the Tinytax module aka Tinytax taxonomy block 5.x before 5.x-1.10-1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML, probably by creating a crafted taxonomy term...

Cross site scripting

Cross-site scripting XSS vulnerability in the Tinytax module aka Tinytax taxonomy block 5.x before 5.x-1.10-1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML, probably by creating a crafted taxonomy term...

CVE-2008-3097

Cross-site scripting XSS vulnerability in the Tinytax module aka Tinytax taxonomy block 5.x before 5.x-1.10-1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML, probably by creating a crafted taxonomy term...

Sql injection

Multiple SQL injection vulnerabilities in index.php in Insanely Simple Blog 0.5 allow remote attackers to execute arbitrary SQL commands via 1 the id parameter, or 2 the term parameter in a search action. NOTE: the currentsubsection parameter is already covered by CVE-2007-3889...