entity api project entity api vulnerabilities and exploits

(subscribe to this query)

NA

The Entity API module 7.x-1.x prior to 7.x-1.2 for Drupal, when using the (a) Views field or (b) area plugins, allows remote malicious users to read restricted entities via the (1) field, (2) header, or (3) footer of a View. NOTE: this identifier was SPLIT from CVE-2013-4273 per ...

Entity Api Project Entity Api 7.x-1.0 Entity Api Project Entity Api

NA

The Entity API module 7.x-1.x prior to 7.x-1.2 for Drupal does not properly restrict access to node comments, which allows remote authenticated users to read the comments via unspecified vectors. NOTE: this identifier was SPLIT per ADT5 due to different researcher organizations. ...

Entity Api Project Entity Api 7.x-1.0 Entity Api Project Entity Api 7.x-1.1

6.5

CVSSv3

The entity wrapper access API in the Entity API module 7.x-1.x prior to 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on referenced entities via unspecified vectors.

Entity Api Project Entity Api 7.x-1.0 Entity Api Project Entity Api 7.x-1.1 Entity Api Project Entity Api 7.x-1.2 Fedoraproject Fedora 20 Fedoraproject Fedora 19

6.5

CVSSv3

The entity wrapper access API in the Entity API module 7.x-1.x prior to 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions on comment, user and node statistics properties via unspecified vectors.

Entity Api Project Entity Api 7.x-1.2 Entity Api Project Entity Api 7.x-1.1 Entity Api Project Entity Api 7.x-1.0 Fedoraproject Fedora 20 Fedoraproject Fedora 19

6.5

CVSSv3

The entity_access API in the Entity API module 7.x-1.x prior to 7.x-1.3 for Drupal might allow remote authenticated users to bypass intended access restrictions and read unpublished comments via unspecified vectors.

Entity Api Project Entity Api 7.x-1.2 Entity Api Project Entity Api 7.x-1.0 Entity Api Project Entity Api 7.x-1.1 Fedoraproject Fedora 19 Fedoraproject Fedora 20

NA

Cross-site scripting (XSS) vulnerability in the Entity API module prior to 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API.

Entity Api Project Entity Api

9

CVSSv3

Anyplace version before commit 80359b4 contains a XML External Entity (XXE) vulnerability in Man in the middle on map API call that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit...

Anyplace Project Anyplace -

7.5

CVSSv3

ventrian News-Articles version NewsArticles.00.09.11 contains a XML External Entity (XXE) vulnerability in News-Articles/API/MetaWebLog/Handler.ashx.vb that can result in Attacker can read any file in the server or use smbrelay attack to access to server..

News-articles Project News-articles 00.09.11

8.1

CVSSv3

libexpat prior to 2.4.9 has a use-after-free in the doContent function in xmlparse.c.

Libexpat Project Libexpat Debian Debian Linux 10.0 Debian Debian Linux 11.0 Fedoraproject Fedora 35 Fedoraproject Fedora 36 Fedoraproject Fedora 37

9.8

CVSSv3

dom4j prior to 2.0.3 and 2.1.x prior to 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j...

Dom4j Project Dom4j Oracle Insurance Policy Administration J2ee 10.2.0 Oracle Insurance Rules Palette 10.2.0 Oracle Retail Integration Bus 15.0 Oracle Webcenter Portal 12.2.1.3.0 Oracle Webcenter Portal 11.1.1.9.0 Oracle Utilities Framework 4.2.0.3.0 Oracle Utilities Framework 4.2.0.2.0 Oracle Utilities Framework 2.2.0.0.0 Oracle Flexcube Core Banking 11.7.0 Oracle Business Process Management Suite 12.2.1.3.0 Oracle Endeca Information Discovery Integrator 3.2.0 Oracle Application Testing Suite 13.3.0.1 Oracle Retail Order Broker 15.0 Oracle Retail Order Broker 16.0 Oracle Retail Integration Bus 16.0 Oracle Retail Customer Management And Segmentation Foundation 16.0 Oracle Retail Customer Management And Segmentation Foundation 17.0 Oracle Retail Customer Management And Segmentation Foundation 18.0 Oracle Enterprise Data Quality 12.2.1.3.0 Oracle Data Integrator 12.2.1.3.0 Oracle Utilities Framework 4.4.0.0.0

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook