CVE-2012-4492

https://notcve.org/view.php?id=CVE-2012-4492

Multiple cross-site scripting (XSS) vulnerabilities in the Shorten URLs module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors to the (1) report or (2) Custom Services List page. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Shorten URLs v6.x-1.x antes de v6.x-1.13 y v7.x-1.x antes de v7.x-1.2 para Drupal, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML a través de vectores no especificados en (1) el informe o (2) la página Custom Services List. • http://drupal.org/node/1719392 http://www.openwall.com/lists/oss-security/2012/10/04/6 http://www.openwall.com/lists/oss-security/2012/10/07/1 http://www.securityfocus.com/bid/54911 https://drupal.org/node/1719306 https://drupal.org/node/1719310 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •