drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team: CVE-2017-6923: Views - Access Bypass - Moderately Critical CVE-2017-6924: REST API can bypass comment approval - Access Bypass - Moderately Critica CVE-2017-6925: Entity access bypass for entities that do not have UUIDs or have protected revisions - Access Bypass - Critical...

CVE-2015-2690: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in views/add-license-form.php in the Digium Addons module digiumaddoninstaller before 2.11.0.7 for FreePBX allow remote attackers to inject arbitrary web script or HTML via the 1 addlicensekey, 2 addlicensefirstname, 3 addlicenselastname, 4...

Phamm 'login_form' function cross-site scripting vulnerability

Phamm is a PHP-based web hosting manager that supports multiple roles with access rights to manage virtual services using an LDAP backend. A cross-site scripting vulnerability exists in the 'loginform' function of the views/helpers.php file in versions of Phamm prior to 0.6.7. A remote attacker c...

Cross site scripting

XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...

CVE-2017-0378

XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...

CVE-2017-0378: Improper Neutralization of Input During Web Page Generation

XSS exists in the loginform function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATHINFO to main.php...

Treehugger External Link System suffers from SQL Injection Vulnerability

Tree Hole external chain system is a free open source PHP external chain network disk system , support for a variety of storage methods , multi-user system . Tree Hole external link system in shudong\views\userFiles file in the existence of SQL injection vulnerability , due to the failure of the...

CVE-2017-9449

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible ...

CVE-2017-9449: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin/modules/developer/modules/views/create.php. The attacker creates a crafted table name at admin/developer/modules/views/create/ and the injection is visible ...

CVE-2016-4977

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

Design/Logic Flaw

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

CVE-2016-4977: Undefined Security Weakness

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for responsetype...

Joomla! v3. 7 SQL injection high-risk vulnerability is a technical analysis of CVE-2017-8917-a vulnerability warning-the black bar safety net

comfields components loopholes, comfields Assembly is in 3. 7 version Added, if you use this version, will be affected and should be updated soon. This component publicly accessible, which means that any be able to access your site the user can initiate the attack. Vulnerability details ! From th...

Jenkins Denial of Service Vulnerability

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Jenkin...

CVE-2017-8302

Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dspnextn.cfm, admin/core/views/cusers/inc/dspsearchform.cfm, admin/core/views/cusers/inc/dspuserslist.cfm,...

Cross site scripting

Mura CMS 7.0.6967 allows admin/?muraAction= XSS attacks, related to admin/core/views/carch/list.cfm, admin/core/views/carch/loadsiteflat.cfm, admin/core/views/cusers/inc/dspnextn.cfm, admin/core/views/cusers/inc/dspsearchform.cfm, admin/core/views/cusers/inc/dspuserslist.cfm,...

Fedora 24 : drupal7-views (2017-bcab179007)

7.x-3.15 - Moderately Critical - Access Bypass - SA-CONTRIB-2017-022 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 25 : drupal7-views (2017-82ce4661d6)

7.x-3.15 - Moderately Critical - Access Bypass - SA-CONTRIB-2017-022 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing...

[SECURITY] Fedora 25 Update: drupal7-views-3.15-1.fc25

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

[SECURITY] Fedora 24 Update: drupal7-views-3.15-1.fc24

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...