CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2009-3920
https://notcve.org/view.php?id=CVE-2009-3920
An administration page in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors. Una página de administración del módulo de integración de Drupal NGP COO/CWP v6.x (crmngp) antes de v6.x-1.12 no realiza el control de acceso esperado, lo que permite leer a atacantes remotos la información de registro a través de vectores no especificados. • http://drupal.org/node/623506 http://drupal.org/node/623546 http://osvdb.org/59677 http://secunia.com/advisories/37287 http://www.securityfocus.com/bid/36927 https://exchange.xforce.ibmcloud.com/vulnerabilities/54153 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2009-3919
https://notcve.org/view.php?id=CVE-2009-3919
Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information." Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo para Drupal NGP COO/CWP Integration (crmngp) v6.x anterior a v6.x-1.12, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de informaión dada por el usuario no especificada. • http://drupal.org/node/623506 http://drupal.org/node/623546 http://osvdb.org/59676 http://secunia.com/advisories/37287 http://www.securityfocus.com/bid/36927 https://exchange.xforce.ibmcloud.com/vulnerabilities/54151 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •