Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-1614
Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php, an invalid (4) page parameter to usermgr.php, or an invalid (5) newer_than or (6) older_than parameter to search.inc.php, which reveals the installation path in an error message.
Affected Products: n/a
References: [{'name': '20120329 [waraxe-2012-SA#081] - Multiple Vulnerabilities in Coppermine 1.5.18', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0167.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.waraxe.us/advisory-81.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.org/files/111369/Coppermine-1.5.18-Cross-Site-Scripting-Path-Disclosure.html'}, {'name': '18680', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18680'}, {'name': '80734', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80734'}, {'name': '80735', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80735'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.6.x/edit_one_pic.php?r1=8348&r2=8354'}, {'name': '80732', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80732'}, {'name': '80733', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80733'}, {'name': '52818', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52818'}, {'name': '[oss-security] 20120330 Re: CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/30/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://forum.coppermine-gallery.net/index.php/topic%2C74682.0.html'}, {'name': '[oss-security] 20120403 Re: CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/03/6'}, {'name': '[oss-security] 20120330 CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/30/5'}]
CVE State: PUBLISHED
Explain CVE-2012-1615
A Privilege Escalation vulnerability exits in Fedoraproject Sectool due to an incorrect DBus file.
Affected Products: sectool
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1615'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/076873.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081113.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/04/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/52884'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74655'}]
CVE State: PUBLISHED
Explain CVE-2012-1616
Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.
Affected Products: n/a
References: [{'name': 'argyll-icc-code-execution(75162)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75162'}, {'name': '48921', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48921'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=809697'}, {'name': '81617', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/81617'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.argyllcms.com/icc_readme.html'}, {'name': '53240', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53240'}, {'name': 'GLSA-201206-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201206-04.xml'}, {'name': 'FEDORA-2012-6529', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079762.html'}, {'name': '49602', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49602'}]
CVE State: PUBLISHED
Explain CVE-2012-1617
Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter.  NOTE: this vulnerability can be leveraged to upload arbitrary files.
Affected Products: n/a
References: [{'name': '20120307 OSClass directory traversal (leads to arbitrary file upload)', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0024.html'}, {'name': '48284', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48284'}, {'name': '[oss-security] 20120403 Re: CVE request: OSClass directory traversal vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/03/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osclass/OSClass/commit/a40b76695994442644e46e1b776d79660500566a'}, {'name': '[oss-security] 20120404 Re: CVE request: OSClass directory traversal vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/04/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.codseq.it/advisories/osclass_directory_traversal_vulnerability'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://osclass.org/2012/03/05/osclass-2-3-6/'}, {'name': '52336', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52336'}, {'name': '[oss-security] 20120402 Re: CVE request: OSClass directory traversal vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/02/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b'}, {'name': '[oss-security] 20120402 CVE request: OSClass directory traversal vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/02/1'}, {'name': 'osclass-directory-traversal(73754)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73754'}, {'name': 'osclass-file-upload(73755)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73755'}]
CVE State: PUBLISHED
Explain CVE-2012-1620
slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.gentoo.org/show_bug.cgi?id=401645'}, {'name': '[oss-security] 20120405 Re: CVE Request: slock-0.9 displays modal box after locking', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/06/2'}, {'name': '[oss-security] 20120405 CVE Request: slock-0.9 displays modal box after locking', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/06/1'}, {'name': '48700', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48700'}, {'name': 'slock-xraisewindow-sec-bypass(74666)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74666'}, {'name': '81035', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/81035'}, {'name': '52922', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52922'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.suckless.org/slock/rev/891a4984aba6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=786310'}]
CVE State: PUBLISHED
Explain CVE-2012-1621
Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message, or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '20120415 [CVE-2012-1621] Apache OFBiz information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://seclists.org/bugtraq/2012/Apr/101'}, {'name': '[www-announce] 20120415 Apache OFBiz 10.04.02 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/www-announce/201204.mbox/%3C2B984C00-EC65-4455-98D3-55735ABE8AF9%40apache.org%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ofbiz.apache.org/download.html#vulnerabilities'}, {'name': '48800', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48800'}, {'name': '81349', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/81349'}, {'name': '81346', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/81346'}, {'name': '81347', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/81347'}, {'name': '20120415 [CVE-2012-1621] Apache OFBiz information\tdisclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2012/Apr/172'}, {'name': 'apache-ofbiz-multiple-xss(74870)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74870'}, {'name': '53023', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53023'}, {'name': '81348', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/show/osvdb/81348'}, {'name': '[ofbiz-dev] 20120415 [CVE-2012-1621] Apache OFBiz information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/ofbiz-dev/201204.mbox/%3CA126EDA0-06A5-4B67-8CDD-FC5F5AABA147%40apache.org%3E'}, {'name': '1026927', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026927'}]
CVE State: PUBLISHED
Explain CVE-2012-1622
Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://ofbiz.apache.org/download.html#security'}, {'name': '[ofbiz-user] 20120415 [CVE-2012-1622] Apache OFBiz information disclosure vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/ofbiz-user/201204.mbox/%3C4F378887-E697-44E7-976C-48B9B7475C4D%40apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2012-1623
The Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the registration code list, which might allow remote attackers to bypass intended registration restrictions.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1394172'}, {'name': '47443', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47443'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '51271', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51271'}, {'name': '78184', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78184'}]
CVE State: PUBLISHED
Explain CVE-2012-1624
Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content.
Affected Products: n/a
References: [{'name': 'lingotek-createedit-xss(72151)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72151'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1394220'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '47453', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47453'}, {'name': '51272', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51272'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1394412'}, {'name': '78185', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78185'}]
CVE State: PUBLISHED
Explain CVE-2012-1625
Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors.  NOTE: Some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': '51288', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51288'}, {'name': '78182', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78182'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1394428'}, {'name': '47418', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47418'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}]
CVE State: PUBLISHED
Explain CVE-2012-1626
SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer Date Tools" privilege to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1401026'}, {'name': '47533', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47533'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '78261', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78261'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1401434'}, {'name': 'date-event-sql-injection(72356)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72356'}, {'name': '51378', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51378'}]
CVE State: PUBLISHED
Explain CVE-2012-1627
Cross-site scripting (XSS) vulnerability in vud_term.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via taxonomy terms.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/vote_up_down.git/commit/fe83aa4b8fa44d83a01494870a80d4651434f4c0'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1401580'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1400530'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1400528'}, {'name': '51376', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51376'}, {'name': '47549', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47549'}]
CVE State: PUBLISHED
Explain CVE-2012-1628
Cross-site scripting (XSS) vulnerability in the SuperCron module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': 'supercron-unspecified-xss(72389)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72389'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1401644'}]
CVE State: PUBLISHED
Explain CVE-2012-1629
Cross-site scripting (XSS) vulnerability in the Taxotouch module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '51387', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51387'}, {'name': 'taxinomynavigator-unspecified-xss(72387)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72387'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1401644'}]
CVE State: PUBLISHED
Explain CVE-2012-1630
Cross-site scripting (XSS) vulnerability in the Taxonomy Navigator module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '51387', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51387'}, {'name': 'taxinomynavigator-unspecified-xss(72387)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72387'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1401644'}]
CVE State: PUBLISHED
Explain CVE-2012-1631
Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack the authentication of administrators for requests that unpublish all nodes, and possibly other actions, via unspecified vectors.
Affected Products: n/a
References: [{'name': '51388', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51388'}, {'name': 'adminhover-unspecified-csrf(72386)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72386'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1401644'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1407206'}]
CVE State: PUBLISHED
Explain CVE-2012-1632
Cross-site scripting (XSS) vulnerability in password_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/password_policy.git/commit/3c688c3b4a3ed96fdc4b89883595633338c7ebb6'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1401678'}, {'name': '51385', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51385'}, {'name': '47541', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47541'}]
CVE State: PUBLISHED
Explain CVE-2012-1633
Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1401678'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/password_policy.git/commit/3c688c3b4a3ed96fdc4b89883595633338c7ebb6'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '51385', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51385'}, {'name': '47541', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47541'}]
CVE State: PUBLISHED
Explain CVE-2012-1634
Cross-site scripting (XSS) vulnerability in video_filter.codecs.inc in the Video Filter module 6.x-2.x and 7.x-2.x for Drupal allows remote attackers to inject arbitrary web script or HTML via the EMBEDLOOKUP parameter for Blip.tv links.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/video_filter.git/commit/49680a6'}, {'name': 'videofilter-unspecified-xss(72359)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72359'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://justin.madirish.net/content/drupal-video-filter-6x-28-xss-vulnerability'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1401838'}, {'name': '51381', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51381'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/video_filter.git/commit/c90c86e'}]
CVE State: PUBLISHED
Explain CVE-2012-1635
The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1407456'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1409268'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}]
CVE State: PUBLISHED
Explain CVE-2012-1636
Cross-site request forgery (CSRF) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of users for requests that delete stickynotes via unspecified vectors.
Affected Products: n/a
References: [{'name': '47650', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47650'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1408556'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1409422'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/stickynote.git/commit/9a7b535'}]
CVE State: PUBLISHED
Explain CVE-2012-1637
Cross-site scripting vulnerability (XSS) in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal.
Affected Products: Quicktabs
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.drupal.org/node/1409476'}]
CVE State: PUBLISHED
Explain CVE-2012-1638
SQL injection vulnerability in the Search Autocomplete module before 7.x-2.1 for Drupal allows remote authenticated users with the "use search_autocomplete" permission to execute arbitrary SQL commands via unspecified vectors.
Affected Products: n/a
References: [{'name': '47731', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47731'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1410674'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '51667', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51667'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1416612'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/search_autocomplete.git/commit/589e8f6'}]
CVE State: PUBLISHED
Explain CVE-2012-1639
Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters.
Affected Products: n/a
References: [{'name': '78528', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/78528'}, {'name': '47730', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47730'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1416824'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module'}, {'name': 'drupal-commerce-multiple-xss(72743)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72743'}, {'name': '51668', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51668'}]
CVE State: PUBLISHED
Explain CVE-2012-1640
Multiple cross-site scripting (XSS) vulnerabilities in the Managesite module 6.x-1.x before 6.1-1.1 for Drupal allow remote authenticated users with "administer managesite" permissions to inject arbitrary web script or HTML via the title parameter when (1) adding or (2) updating a category.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1417000'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '47732', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47732'}, {'name': 'drupal-managesite-category-xss(72742)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72742'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/managesite.git/blobdiff/7dd99c47d891d482be1430d3c06a5bb0f6c74d85..7051b7e:/managesite.module'}, {'name': '51669', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51669'}]
CVE State: PUBLISHED
Explain CVE-2012-1641
The finder_import function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1432320'}, {'name': '79014', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79014'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1432318'}, {'name': '[oss-security] 20120319 Re: CVE-request: Drupal Finder SA-CONTRIB-2012-017', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/finder.git/commit/bc0cc82'}, {'name': '[oss-security] 20120316 CVE-request: Drupal Finder SA-CONTRIB-2012-017', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.madirish.net/content/drupal-finder-6x-19-xss-and-remote-code-execution-vulnerabilities'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1432970'}, {'name': '47943', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47943'}, {'name': '47915', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47915'}]
CVE State: PUBLISHED
Explain CVE-2012-1642
includes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does not properly enforce access permissions on broken links, which allows remote attackers to obtain sensitive information via unspecified vectors.
Affected Products: n/a
References: [{'name': '48022', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48022'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/linkchecker.git/commit/fef0ddf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1441252'}, {'name': '79315', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79315'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1440508'}]
CVE State: PUBLISHED
Explain CVE-2012-1643
The Faster Permissions module 7.x-2.x before 7.x-1.2 for Drupal does not check the "administer permissions" permission, which allows remote attackers to modify access permissions via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1441448'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1441556'}, {'name': '79316', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79316'}, {'name': '48019', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48019'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/fp.git/commitdiff/39e7587'}]
CVE State: PUBLISHED
Explain CVE-2012-1644
The Organic Groups (OG) Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1441086'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/og_vocab.git/commitdiff/cd8de08'}, {'name': 'ogvocabulary-title-xss(53902)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/53902'}, {'name': '79336', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79336'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1441450'}, {'name': '48020', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48020'}]
CVE State: PUBLISHED
Explain CVE-2012-1645
The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1441480'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/cdn.git/commitdiff/eca85e6'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1441502'}, {'name': '79317', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79317'}, {'name': '48032', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48032'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1441482'}]
CVE State: PUBLISHED
Explain CVE-2012-1646
Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1451194'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/faq.git/commit/912f1d2'}, {'name': '79466', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79466'}, {'name': '48131', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48131'}, {'name': '52126', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52126'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/faq.git/blobdiff/525fb85e5a43cb6cfe3028aa88eaf8a6e40548d5..f381756:/faq.admin.inc'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/faq.git/commit/f381756'}, {'name': 'drupal-faq-unspecified-xss(73452)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73452'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/faq.git/blobdiff/2991dd94e70a2881571a4b777645f4dcc42c1f10..912f1d2:/faq.module'}]
CVE State: PUBLISHED
Explain CVE-2012-1647
Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via (1) $_SERVER['HTTP_HOST'] or (2) $_SERVER['SCRIPT_NAME'] to players/osmplayer/player/OSMPlayer.php, (3) playlist parameter to players/osmplayer/player/getplaylist.php, and possibly other vectors related to $_SESSION.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1461424'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/mediafront.git/commitdiff/b3857aa'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/mediafront.git/commitdiff/6300750'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1460892'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': '52229', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52229'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1460894'}, {'name': '79684', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79684'}, {'name': 'mediafront-phplibrary-xss(73606)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73606'}]
CVE State: PUBLISHED
Explain CVE-2012-1648
Cross-site scripting (XSS) vulnerability in the Cool Aid module before 6.x-1.9 for Drupal allows remote authenticated users with the administer coolaid permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': 'coolaid-helpmessages-xss(73607)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73607'}, {'name': '48196', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48196'}, {'name': '52232', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52232'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1461438'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1417186'}, {'name': '79712', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79712'}]
CVE State: PUBLISHED
Explain CVE-2012-1649
Cool Aid module before 6.x-1.9 for Drupal does not enforce access restrictions, which allows remote authenticated users with the administer coolaid permission to modify arbitrary pages via unspecified vectors.
Affected Products: n/a
References: [{'name': '48196', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48196'}, {'name': 'coolaid-helpmessages-security-bypass(73608)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73608'}, {'name': '52232', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52232'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1461438'}, {'name': '79772', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79772'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1417186'}]
CVE State: PUBLISHED
Explain CVE-2012-1650
The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://drupal.org/node/1461446'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1460892'}, {'name': '79766', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79766'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'name': 'zipcart-archives-security-bypass(73609)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73609'}, {'name': '52231', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52231'}]
CVE State: PUBLISHED
Explain CVE-2012-1651
Cross-site scripting (XSS) vulnerability in the Submenu Tree module before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1461470'}, {'name': '79696', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79696'}, {'name': '52226', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52226'}, {'name': '48202', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48202'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1132838'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}]
CVE State: PUBLISHED
Explain CVE-2012-1652
Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1461318'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1461724'}, {'name': '48235', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48235'}, {'name': '79683', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79683'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/hierarchical_select.git/commit/be32dceb17d25553e474c295a8c3db69eab95cee'}, {'name': '52228', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52228'}, {'name': 'hierarchicalselect-textvocabularies-xss(73611)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73611'}]
CVE State: PUBLISHED
Explain CVE-2012-1653
Cross-site scripting (XSS) vulnerability in the Taxonomy Views Integrator (TVI) module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, related to "views pages."
Affected Products: n/a
References: [{'name': '79682', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79682'}, {'name': 'taxonomyviews-viewpages-xss(73612)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73612'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1306946'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1461892'}, {'name': '48163', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48163'}, {'name': '52227', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52227'}]
CVE State: PUBLISHED
Explain CVE-2012-1654
Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x before 7.x-1.0-alpha3 for Drupal allow remote authenticated users with the administer data tables permission to inject arbitrary web script or HTML via the title parameter in (1) data.views.inc and (2) data_ui/data_ui.admin.inc.
Affected Products: n/a
References: [{'name': '48326', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48326'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/data.git/commit/33f0caa'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.madirish.net/content/drupal-data-6x-10-xss-vulnerability'}, {'name': '79854', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79854'}, {'name': '52337', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52337'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1470980'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/data.git/commit/6f6858a'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1470982'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1471780'}]
CVE State: PUBLISHED
Explain CVE-2012-1655
Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain account credentials via unknown attack vectors.
Affected Products: n/a
References: [{'name': '52344', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52344'}, {'name': 'ucpaydutch-unspec-information-disclsoure(73897)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73897'}, {'name': '79855', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79855'}, {'name': "[oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments)", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/04/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1471800'}]
CVE State: PUBLISHED