CVE-2008-4440

The to-upgrade plugin in feta 1.4.16 allows local users to overwrite arbitrary files via a symlink on the 1 /tmp/feta.install.$USER and 2 /tmp/feta.avail.$USER temporary files...

CVE-2008-4440

The CVE-2008-4440 issue affects feta’s to-upgrade plugin, where insecure handling of temporary files enables local users to exploit symbolic links to overwrite /tmp/feta.install.$USER and /tmp/feta.avail.$USER. The root cause is insecure temp-file creation in feta 1.4.16. Public references descri...

Drupal core - Multiple cross site scripting vulnerabilities

Some server variables are not escaped consistently. When a malicious user is able to entice a victim to visit a specially crafted link or webpage, arbitrary HTML and script code can be injected and executed in the context of the victim's session on the targeted website. Custom content type names...