Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001

Access bypass Password reset URLs - Drupal 6 and 7 Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be...

Open redirect

Multiple open redirect vulnerabilities in u5CMS before 3.9.4 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 1 pidvesa cookie to u5admin/pidvesa.php or 2 uri parameter to u5admin/meta2.php...

xdg-utils Eval Injection Vulnerability

xdg-utils is a set of command line tools used to help applications integrate with various desktop tasks. An Eval injection vulnerability exists in xdg-utils version 1.1.0 RC1. An attacker can exploit this vulnerability to execute arbitrary code with the help of the 'URL' parameter...

MediaWiki Listings Extension Cross-Site Scripting Vulnerability

MediaWiki is a Wiki program. The MediaWiki Listings page fails to adequately filter the 'name' or 'url' parameter, which can be exploited by remote attackers to inject arbitrary web script or HTML...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 url parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages...

PT-2015-5043

Name of the Vulnerable Software and Affected Versions Brother MFC-J4410DW printer with firmware before L Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the url parameter to "general/status.html" and possibly other pages...

CVE-2015-1056: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages...

PT-2015-4234

Name of the Vulnerable Software and Affected Versions MediaWiki Listings extension affected versions not specified Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the name or...

CVE-2014-9477: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Listings extension for MediaWiki allow remote attackers to inject arbitrary web script or HTML via the 1 name or 2 url parameter...

CVE-2015-1051

Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

CVE-2014-10037

DomPHP 0.83 and earlier is affected by a directory traversal vulnerability. The Nuclei template details that an attacker can exploit via a part of the URL parameter to photoalbum/index.php (.. traversal) to read, modify, or delete sensitive files on the server. The CVE entry confirms this issue w...

PT-2015-3681

Name of the Vulnerable Software and Affected Versions DomPHP versions 0.83 and earlier Description A directory traversal issue exists, allowing remote attackers to have an unspecified impact by including a .. dot dot in the url parameter to the "photoalbum/index.php" endpoint. Recommendations For...

CVE-2014-10037: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impact via a .. dot dot in the url parameter to photoalbum/index.php...

PHPDug has multiple cross-site scripting vulnerabilities

PHPDug is an open source social news site that supports sharing stories, news, images and more. PHPDug 2.0.0 suffers from multiple cross-site scripting vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via the storyurl parameter to addstoryphp editprofilephp, and...

CVE-2014-7293

Cross-site scripting XSS vulnerability in the logon page in NYU OpenSSO Integration 2.1 and earlier for Ex Libris Patron Directory Services PDS allows remote attackers to inject arbitrary web script or HTML via the url parameter...

PT-2015-3926

Name of the Vulnerable Software and Affected Versions Ex Libris Patron Directory Services PDS NYU OpenSSO Integration versions 2.1 and earlier Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter. This c...

PT-2015-3925

Name of the Vulnerable Software and Affected Versions Ex Libris Patron Directory Services PDS NYU OpenSSO Integration versions 2.1 and earlier Description A cross-site scripting XSS issue exists in the logon page, allowing remote attackers to inject arbitrary web script or HTML via the url...

CVE-2014-7294: Undefined Security Weakness

Open redirect vulnerability in the logon page in NYU OpenSSO Integration 2.1 and earlier for Ex Libris Patron Directory Services PDS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter...

CVE-2014-7293: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the logon page in NYU OpenSSO Integration 2.1 and earlier for Ex Libris Patron Directory Services PDS allows remote attackers to inject arbitrary web script or HTML via the url parameter...