EUVD-2012-5441

Malware in sbrugna...

CVE-2012-5549

Cross-site request forgery CSRF vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2012-5548

Cross-site scripting XSS vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5549

Cross-site request forgery CSRF vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Sql injection

SQL injection vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5549

CVE-2012-5549 : CSRF vulnerability in the Drupal contributed Time Spent module (6.x/7.x) allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. The Time Spent module had insufficient input sanitization, affecting all versions. Drupal core is not affected....

CVE-2012-5548

CVE-2012-5548 is a Drupal Time Spent module (6.x/7.x) XSS vulnerability caused by insufficient input sanitization. Reports in the Drup al security advisory note multiple vulnerabilities (XSS, CSRF, SQL injection) across all Time Spent module versions, with Drupal core unaffected. Remediation per ...

CVE-2012-5548

Cross-site scripting XSS vulnerability in the Time Spent module 6.x and 7.x for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-5550

Summary: CVE-2012-5550 describes a SQL injection vulnerability in the Drupal contributed Time Spent module (versions 6.x and 7.x). The underlying issue is that the module does not sufficiently sanitize user input, enabling remote attackers to execute arbitrary SQL commands via unspecified vectors...

SA-CONTRIB-2012-157 - Time Spent - Multiple Vulnerabilities - (unsupported)

The Time Spent module tracks the time a registered user spends on a site and a site's content. The module doesn't sufficiently sanitize user input. Cross site scripting, cross-site request forgery, and SQL injection vulnerabilities have all been found. Note that none of these vulnerabilities have...