2569 matches found
DEBIAN-CVE-2012-3540
Open redirect vulnerability in views/authforms.py in OpenStack Dashboard Horizon Essex 2012.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by...
CVE-2012-2064
Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...
CVE-2012-2064
The CVE-2012-2064 vulnerability affects the Drupal Views Language Switcher module (7.x) prior to 7.x-1.2. The issue is an XSS in theme/views_lang_switch.theme.inc that allows remote attackers to inject arbitrary scripts/HTML via the q parameter. Impact is XSS against anonymous users with the vuln...
CVE-2012-2064: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in theme/viewslangswitch.theme.inc in the Views Language Switcher module before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter...
CVE-2012-3540: Improper Input Validation
Open redirect vulnerability in views/authforms.py in OpenStack Dashboard Horizon Essex 2012.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/. NOTE: this issue was originally assigned CVE-2012-3542 by...
SA-CONTRIB-2012-134 - Views - Privilege Escalation
The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. The module incorrectly modifies the global user object in some situations when a view has a uid argument and performs validation on...
ManageEngine OpUtils 6.0 - Persistent Cross-Site Scripting
Author: loneferret of Offensive Security Product: ManageEngine OpUtils Version: 6 Vendor Site: http://www.manageengine.com Software Download: http://www.manageengine.com/products/oputils/download.html Software Description: http://www.manageengine.com/products/oputils/oputils.html The toolset can ...
SA-CONTRIB-2012-127 - Custom Publishing Options - Cross Site Scripting (XSS) Vulnerability
The Custom Publishing Options module allows you to create custom publishing options for nodes. It allows you to add to the default options of Publish, Promote to Front Page, and Sticky. It also ingrates with views to allow you add as a field, sort and filter by, your custom options. The module...
CVE-2012-2081
The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...
CVE-2012-2074
Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...
Design/Logic Flaw
Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...
Design/Logic Flaw
The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...
CVE-2012-2074
The CVE-2012-2074 entry concerns Ubercart Views for Drupal 6.x before 6.x-3.2, where default views contain a critical information-disclosure weakness. The Drupal SA-CONTRIB advisory confirms affected versions and provides remediation: upgrade to Ubercart Views 6.x-3.2 and, after upgrading, ensure...
CVE-2012-2074
Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...
CVE-2012-2074: Undefined Security Weakness
Unspecified vulnerability in certain default views in the Ubercart Views module 6.x before 6.x-3.2 for Drupal allows remote attackers to obtain sensitive information via unknown attack vectors...
CVE-2012-2081: Undefined Security Weakness
The Organic Groups OG module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module...
Django跨站脚本执行和两个拒绝服务漏洞
BUGTRAQ ID: 54742 CVE ID: CVE-2012-3442,CVE-2012-3443,CVE-2012-3444 Django是Python编程语言驱动的一个开源Web应用程序框架。 Django 1.3和1.4及其他版本在实现上存在两个安全漏洞，可被恶意用户利用执行跨站脚本攻击和拒绝服务。 1）验证框架中的login或logout试图的重定向功能内传递的输入，在重定向到"data:" scheme URL后没有正确过滤就返回给用户。 2）解压图形时，ImageField类中的图形验证中存在错误，可被利用消耗大量内存资源。...
Authorization
The remote SVN views functionality lib/vclib/svn/svnra.py in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors...
