CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2009-2237
https://notcve.org/view.php?id=CVE-2009-2237
Unspecified vulnerability in Views Bulk Operations 5.x-1.x before 5.x-1.4 and 6.x-1.x before 6.x-1.7, a module for Drupal, allows remote attackers to bypass intended access restrictions and modify "nodes or classes of nodes" via unknown vectors, probably related to registered procedures (aka actions). Vulnerabilidad no especificada en Views Bulk Operations 5.x-1.x antes de 5.x-1.4 y 6.x-1.x ante de 6.x-1.7, un modulo para Drupal, permite a atacantes remotos evitar las restricciones de acceso previstas y modificar "nodos o clases de nodos" mediante vectores desconocidos, probablemente relacionado con procedimientos registrados (alias acciones). • http://drupal.org/node/468450 http://secunia.com/advisories/35117 http://www.securityfocus.com/bid/35051 https://exchange.xforce.ibmcloud.com/vulnerabilities/50659 •
CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2009-0575
https://notcve.org/view.php?id=CVE-2009-0575
Cross-site scripting (XSS) vulnerability in the theme_views_bulk_operations_confirmation function in views_bulk_operations.module in Views Bulk Operations 5.x before 5.x-1.3 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to node titles. NOTE: some of these details are obtained from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función theme_views_bulk_operations_confirmation en views_bulk_operations.module en Views Bulk Operations v5.x anteriores a v5.x-1.3 y v6.x anteriores a v6.x-1.4, un módulo para Drupal, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados relacionados con los títulos de nodo. • http://drupal.org/node/369223 http://osvdb.org/51751 http://secunia.com/advisories/33836 http://www.securityfocus.com/bid/33622 https://exchange.xforce.ibmcloud.com/vulnerabilities/48516 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •