Page 118 of 723 results (0.015 seconds)

CVSS: 3.5EPSS: 0%CPEs: 27EXPL: 0

CVE-2009-2610

https://notcve.org/view.php?id=CVE-2009-2610

Cross-site scripting (XSS) vulnerability in the Links Related module in the Links Package 5.x before 5.x-1.13 and 6.x before 6.x-1.2, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via the title field. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo Links Related en Links Package v5.x anteriores a v5.x-1.13 y v6.x anteioriores a v6.x-1.2, un módulo para Drupal, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML de su elección mediante el campo "title". • http://drupal.org/node/501356 http://drupal.org/node/501360 http://drupal.org/node/502112 http://osvdb.org/55326 http://secunia.com/advisories/35557 http://www.securityfocus.com/bid/35491 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.8EPSS: 0%CPEs: 16EXPL: 0

CVE-2009-2572

https://notcve.org/view.php?id=CVE-2009-2572

Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en módulo Fivestar v5.x-1.x anteriores v5.x-1.14 y v6.x-1.x anteriores v6.x-1.14, un módulo de Drupal, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección para peticiones de votación. • http://drupal.org/node/449026 http://drupal.org/node/449028 http://drupal.org/node/449042 http://osvdb.org/54154 http://secunia.com/advisories/34956 http://www.vupen.com/english/advisories/2009/1215 https://exchange.xforce.ibmcloud.com/vulnerabilities/50245 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 4.3EPSS: 0%CPEs: 44EXPL: 1

CVE-2009-2373

https://notcve.org/view.php?id=CVE-2009-2373

Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo Forum en Drupal v.6.x anteriores a v.6.13 permite a los atacantes remotos inyectar código web o HTM a través de vectores no especificados. • http://drupal.org/node/507572 http://osvdb.org/55524 http://secunia.com/advisories/35681 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0

CVE-2009-2370

https://notcve.org/view.php?id=CVE-2009-2370

Cross-site scripting (XSS) vulnerability in Advanced Forum 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Advanced Forum v5.x anteriores a v5.x-1.1 y v6.x anteriores a v6.x-1.1, un modulo de Drupal permite a los atacantes remotos inyectar código web o HTM a través de vectores no especificados. • http://drupal.org/node/507526 http://drupal.org/node/507550 http://drupal.org/node/507580 http://osvdb.org/55521 http://secunia.com/advisories/35678 http://secunia.com/advisories/35682 http://www.vupen.com/english/advisories/2009/1769 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0

CVE-2009-2371

https://notcve.org/view.php?id=CVE-2009-2371

Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature. Advanced Forum v6.x anteriores a v6.x-1.1, un módulo de Drupal, no impide a los usuarios modificar sus firmas después de que el formato comentado asociado ha sido cambiado a un formato de entrada controlado por administrador, que permite a usuarios autentificados remotamente inyectar codigo web, HTML y posiblemente código PHP, a su elección, a través de la firma Crafted user. • http://drupal.org/node/507526 http://drupal.org/node/507580 http://osvdb.org/55522 http://secunia.com/advisories/35678 http://www.vupen.com/english/advisories/2009/1769 • CWE-264: Permissions, Privileges, and Access Controls •