SA-CONTRIB-2010-078 - Kaltura - Information disclosure

The Kaltura module integrates the Kaltura open source video platform with Drupal. When installing, uninstalling, or configuring the module, it would surreptitiously inject a hidden iframe into the messages displayed to the administrator with the source pointing to corp.kaltura.com/stats/drupal...

dotDefender 4.02 - 'clave' Cross-Site Scripting

source: https://www.securityfocus.com/bid/41541/info dotDefender is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context o...

HTTP 1.1 - GET Directory Traversal

source: https://www.securityfocus.com/bid/39590/info The HTTP application is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. Exploiting this issue will allow an attacker to view arbitrary local files and directories within the context of...

Spring Framework - Arbitrary code Execution

CVE-2010-1622: Spring Framework execution of arbitrary code Severity: Critical Vendor: SpringSource, a division of VMware Versions Affected: 3.0.0 to 3.0.2 2.5.0 to 2.5.6.SEC01 community releases 2.5.0 to 2.5.7 subscription customers Earlier versions may also be affected Description: The Spring...

OneHTTPD 0.6 - Directory Traversal

source: https://www.securityfocus.com/bid/39757/info OneHTTPD is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks. OneHTTPD...

SA-CONTRIB-2010-021 - AddThis Button - Cross Site Scripting

The AddThis module provides an easy way to share content to over 230 supported services such as Facebook, Email and Twitter. The module did not sanitize some user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability. Only users with the 'administer addthis'...

Blax Blog 0.1 - girisyap.php SQL Injection

Blax Blog 0.1 - girisyap.php SQL Injection source: https://www.securityfocus.com/bid/38465/info Blax Blog is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

Yara Hosting SQL Injection

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::: Exploit Title :yara hosting SQL injection Vulnerability Author: Quimo and Meister Software Link: Version: all version Tested on: yes My home : th3-0utl4ws.com...

Bits Video Script 2.05 Gold Beta - 'showcasesearch.php?rowptem[template]' Remote File Inclusion

source: https://www.securityfocus.com/bid/40709/info Bits Video Script is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute...

DieselPay 1.6 - Cross-Site Scripting / Directory Traversal

source: https://www.securityfocus.com/bid/37564/info DieselPay is prone to a cross-site scripting vulnerability and a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker could exploit these vulnerabilities to obtain sensitive information,...

UBBCentral UBB.Threads 7.5.4 2 - Multiple File Inclusions

UBBCentral: http://www.ubbcentral.com/ UBB.threads is prone to multiple file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible...

Sahana 0.6.2 - 'mod' Local File Disclosure

source: https://www.securityfocus.com/bid/36826/info Sahana is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input. An attacker can exploit this vulnerability to obtain potentially sensitive information from local files on computers running t...

Mega File Hosting Script 1.2 - emaillinks.php Cross-Site Scripting

Mega File Hosting Script 1.2 - emaillinks.php Cross-Site Scripting source: https://www.securityfocus.com/bid/36413/info Mega File Hosting Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execu...

eCardMAX - Multiple Cross-Site Scripting Vulnerabilities

eCardMAX - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/43570/info eCardMAX is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary...

Joomla! Component Permis 1.0 (com_groups) - 'id' SQL Injection

source: https://www.securityfocus.com/bid/35849/info The Permis 'comgroups' component for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise th...

Flatnux 2009-03-27 - Multiple Cross-Site Scripting Vulnerabilities

Flatnux 2009-03-27 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/44454/info FlatNux is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data. An attacker may leverage these issues to execute...

SA-CONTRIB-2009-029 - Views Bulk Operations - Access Bypass

Views Bulk operations allows registered procedures called actions to be applied on a result set of Drupal nodes, returned by the Views module. Through the Views Bulk Operations interface, it is possible to let users who are not authorized to update specific nodes or classes of nodes, to still app...

Novell Teaming 1.0 - User Enumeration Multiple Cross-Site Scripting Vulnerabilities

Novell Teaming 1.0 - User Enumeration Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/34531/info Novell Teaming is prone to a user-enumeration weakness and multiple cross-site scripting vulnerabilities. A remote attacker can exploit the user-enumeration...

Joomla! / Mambo Component gigCalendar 1.0 - 'banddetails.php' SQL Injection

source: https://www.securityfocus.com/bid/33859/info The gigCalendar component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise...

Clipbucket 1.7 - 'dwnld.php' Directory Traversal

source: https://www.securityfocus.com/bid/33781/info ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data. Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks...