Services - Critical - SQL Injection - SA-CONTRIB-2017-054

This module provides a standardized solution for building API's so that external clients can communicate with Drupal. The module doesn't sufficiently sanitize column names provided by the client when they are querying for data and trying to sort it. This vulnerability is mitigated by the fact tha...

tour.tiffanytyler.com XSS vulnerability

Open Bug Bounty ID: OBB-228809 Description| Value ---|--- Affected Website:| tour.tiffanytyler.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CMS Null dereference

Applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a bug in the handling of the ASN.1 CHOICE type in OpenSSL 1.1.0 which can result in a NULL value being passed to the structure callback if an attempt is made to free certain invalid encodings...

CVE-2013-6019

Cross-site scripting XSS vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTML via the accountNum parameter to an unspecified component...

CVE-2013-6018

Cross-site request forgery CSRF vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password...

CVE-2013-6020

passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the 1 Assessor, 2 Recorder, or ...

Cross site scripting

Cross-site scripting XSS vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTML via the accountNum parameter to an unspecified component...

Cross site request forgery (csrf)

The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-structure information via an invalid search request, a different vulnerability than CVE-2013-6020...

Code injection

passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the 1 Assessor, 2 Recorder, or ...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password...

CVE-2013-6285

The search component in the Treasurer application in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to obtain sensitive query-structure information via an invalid search request, a different vulnerability than CVE-2013-6020...

CVE-2013-6285

The vulnerability CVE-2013-6285 affects the Treasurer application’s search component in Tyler Technologies TaxWeb 3.13.3.1. It allows remote attackers to obtain sensitive query-structure information by sending an invalid search request. This is described as a separate issue from CVE-2013-6020. Th...

CVE-2013-6018

CVE-2013-6018 describes a cross-site request forgery (CSRF) vulnerability in Tyler Technologies’ TaxWeb 3.13.3.1, specifically affecting the login.jsp page. The issue allows a remote attacker to hijack the authentication of arbitrary users by inducing them to perform a password-changing action, i...

CVE-2013-6020

passwordRequestPOST.jsp in Tyler Technologies TaxWeb 3.13.3.1 sends different HTTP status codes for invalid password-recovery requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests to the 1 Assessor, 2 Recorder, or ...

CVE-2013-6019

CVE-2013-6019 affects Tyler Technologies TaxWeb 3.13.3.1. The Red Hat/NVD entries describe a reflected cross-site scripting vulnerability: an attacker can inject arbitrary HTML/script via the vulnerable accountNum parameter to an unspecified component. Impact stated across sources is that a remot...

CVE-2013-6020

The issue (CVE-2013-6020) affects Tyler Technologies TaxWeb 3.13.3.1 and its Password Reset flow (passwordRequestPOST.jsp). The root cause is that invalid password-recovery requests return different HTTP status codes depending on whether the target user exists, enabling remote attackers to enumer...

CVE-2013-6019

Cross-site scripting XSS vulnerability in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to inject arbitrary web script or HTML via the accountNum parameter to an unspecified component...

CVE-2013-6018

Cross-site request forgery CSRF vulnerability in login.jsp in Tyler Technologies TaxWeb 3.13.3.1 allows remote attackers to hijack the authentication of arbitrary users for requests that change a password...

Tyler Technologies TaxWeb 3.13.3.1 contains multiple vulnerabilities

Overview Tyler Technologies TaxWeb 3.13.3.1 and possibly earlier versions contain cross-site request forgery CWE-352, information exposure CWE-203, and reflected cross-site scripting CWE-79 vulnerabilities. Description CWE-352: Cross-Site Request Forgery CSRF - CVE-2013-6018TaxWeb 3.13.3.1...

Anonymous going to lauch wikileaks like project called TYLER

International hacker group Anonymous is going to create a WikiLeaks competitor scandalous leak portal called Tyler, for the publication of secret information from governments of various countries. One of the group's members, who specified that he is representing the collective, spoke about the...