SA-CONTRIB-2012-134 - Views - Privilege Escalation

The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. The module incorrectly modifies the global user object in some situations when a view has a uid argument and performs validation on...

ManageEngine OpUtils 6.0 - Persistent Cross-Site Scripting

Author: loneferret of Offensive Security Product: ManageEngine OpUtils Version: 6 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/oputils/download.html Software Description: http://www.manageengine.com/products/oputils/oputils.html The toolset can ...

SA-CONTRIB-2012-127 - Custom Publishing Options - Cross Site Scripting (XSS) Vulnerability

The Custom Publishing Options module allows you to create custom publishing options for nodes. It allows you to add to the default options of Publish, Promote to Front Page, and Sticky. It also ingrates with views to allow you add as a field, sort and filter by, your custom options. The module...

CVE-2012-2081

The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...

CVE-2012-2074

Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...

Design/Logic Flaw

Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...

Design/Logic Flaw

The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...

CVE-2012-2074

Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...

CVE-2012-2074

The CVE-2012-2074 entry concerns Ubercart Views for Drupal 6.x before 6.x-3.2, where default views contain a critical information-disclosure weakness. The Drupal SA-CONTRIB advisory confirms affected versions and provides remediation: upgrade to Ubercart Views 6.x-3.2 and, after upgrading, ensure...

Django跨站脚本执行和两个拒绝服务漏洞

BUGTRAQ ID: 54742 CVE ID: CVE-2012-3442,CVE-2012-3443,CVE-2012-3444 Django是Python编程语言驱动的一个开源Web应用程序框架。 Django 1.3和1.4及其他版本在实现上存在两个安全漏洞，可被恶意用户利用执行跨站脚本攻击和拒绝服务。 1）验证框架中的login或logout试图的重定向功能内传递的输入，在重定向到"data:" scheme URL后没有正确过滤就返回给用户。 2）解压图形时，ImageField类中的图形验证中存在错误，可被利用消耗大量内存资源。...

Authorization

The remote SVN views functionality lib/vclib/svn/svnra.py in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors...

CVE-2012-3356

Removed by vendor...

Elite Bulletin Board SQL Injection Vulnerability

Elite Bulletin Board is an advanced Bulletin Board program that provides advanced features such as CAPTCHA, sub-board, skinning ability, multilingual, commercial password encryption, and much more. 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 ...

Fedora 16 : viewvc-1.1.15-1.fc16 (2012-9371)

Version 1.1.14 released 12-Jun-2012 - fix annotation of svn files with non-URI-safe paths issue 504 - handle file:/// Subversion rootpaths as local roots issue 446 - fix bug caused by trying to case-normalize anon usernames issue 505 - speed up log handling by reusing tokenization results issue 5...

CVE-2012-2721

The default views in the Organic Groups OG module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote attackers to bypass access restrictions and possibly have other unspecified impact...

[SECURITY] Fedora 16 Update: php-symfony-symfony-1.4.18-1.fc16

Symfony is a complete framework designed to optimize the development of web applications by way of several key features. For starters, it separates a w eb application's business rules, server logic, and presentation views. It contains numerous tools and classes aimed at shortening the development...

Fedora Update for drupal6-views FEDORA-2011-15352

Check for the Version of drupal6-views OpenVAS Vulnerability Test Fedora Update for drupal6-views FEDORA-2011-15352 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Fedora Update for drupal6-views FEDORA-2011-15352

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

SA-CONTRIB-2012-047 - Ubercart Views - Information disclosure

CVE: CVE-2012-2074 Ubercart Views provides Views integration for the Ubercart shopping cart module, and includes default views that contain a critical information disclosure bug. In some versions, these views are disabled by default, but still disclose information if you enable them. Versions...

SA-CONTRIB-2012-053 - Organic Groups - Access Bypass

CVE: CVE-2012-2081 Organic groups OG enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. The module's Views integration does not filter out information from display groups to whic...