[oss-security] CVE request: Drupal Flag 7.x-3.5 Module Vulnerability report: Arbitrary code execution due to improper input handling in flag importer

Good morning, Could a CVE please be assigned to http://seclists.org/fulldisclosure/2014/May/44 if one has not been already? Apart from version 7, drupal6-flag-2.1-1.fc20 looks affected - patch applies, but I did not test it. For an older version, drupal6-flag-1.3-3.fc19 appears unaffected. Cheers...

SA-CONTRIB-2014-053 - Field API Tab Editor (FATE) - Access bypass

This module allows each entity field to be individually edited via its own custom page, accessible via a tab on the entity's page. The module returns an incorrect value to hookmenu if the current user does not have access to edit the entity. This allows users who would not normally have access to...

SA-CONTRIB-2014-048 - Field API Pane Editor (FAPE) - Access bypass

This module adds a contextual menu to fields which are added to an entity display in Panels, allowing individual fields to be directly edited via a separate page or, if it is enabled, the Overlay module. The module doesn't sufficiently verify the user has access to modify the entity the field is...

Input validation

Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...

Oracle Java SE 5.x, 6.x, 7.x, 8.x Multiple Vulnerabilities (cpuapr2014) - Windows

Oracle Java SE is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Oracle Java SE 6.x, 7.x, 8.x Multiple Vulnerabilities (cpuapr2014) - Windows

Oracle Java SE is prone to multiple vulnerabilities. Copyright C 2014 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Oracle Java SE Privilege Escalation Vulnerability (Feb 2014) - Windows

Oracle Java SE is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:oracle:jre";...

CVE-2014-1476

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page...

CVE-2013-6386

Removed by vendor...

tomcat: Session fixation in form authenticator

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a...

Memory corruption

Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted XML document...

SA-CONTRIB-2013-076 - jQuery Countdown - Cross Site Scripting (XSS)

This jQuery Countdown Module enables you to display a countdown block based upon date settings. The jQuery Countdown Module does not properly sanitize the settings, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting XSS vulnerability. This vulnerability ...

Microsoft Internet Explorer Multiple Vulnerabilities (2862772)

This host is missing a critical security update according to Microsoft Bulletin MS13-059. OpenVAS Vulnerability Test $Id: secpodms13-059.nasl 6079 2017-05-08 09:03:33Z teissa $ Microsoft Internet Explorer Multiple Vulnerabilities 2862772 Authors: Thanga Prakash S Copyright: Copyright c 2013 SecPo...

Oracle Java SE Multiple Vulnerabilities -04 (Jun 2013) - Windows

Oracle Java SE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Java SE Multiple Vulnerabilities -02 (Jun 2013) - Windows

Oracle Java SE is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Java SE Multiple Vulnerabilities -01 June 13 (Windows)

This host is installed with Oracle Java SE and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gboraclejavasemultvuln01jun13win.nasl 7699 2017-11-08 12:10:34Z santu $ Oracle Java SE Multiple Vulnerabilities -01 June 13 Windows Authors: Thanga Prakash S Copyright: Copyright c...

Apache Tomcat Session Fixation Vulnerability (Nov 2012) - Windows

Apache Tomcat is prone to a session fixation vulnerability. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...

Apache Tomcat Information Disclosure Vulnerability (May 2013) - Windows

Apache Tomcat is prone to an information disclosure vulnerability. Copyright C 2013 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

High-risk vulnerabilities CVE-2 0 1 3-0 0 2 7 EXP, the impact of IE on all versions-bug warning-the black bar safety net

Microsoft Internet Explorer handles CPasteComma there is a use-after-free error allows constructing a malicious WEB page and entice a user to parse, can be the application context to execute arbitrary code. CVE number CVE-2 0 1 3-0 0 2 7, The impact of the version as follows: Microsoft Internet...

Oracle Java SE Multiple Vulnerabilities -02 Feb 13 (Windows)

This host is installed with Oracle Java SE and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: secpodoraclejavasemultvuln02feb13win.nasl 28074 2013-02-22 13:41:39Z feb$ Oracle Java SE Multiple Vulnerabilities -02 Feb 13 Windows Authors: Arun Kallavi Copyright: Copyright c 20...