CVSS: 5.4EPSS: 0%CPEs: 3EXPL: 2CVE-2013-4275
https://notcve.org/view.php?id=CVE-2013-4275
Cross-site scripting (XSS) vulnerability in the zen_breadcrumb function in template.php in the Zen theme 6.x-1.x, 7.x-3.x before 7.x-3.2, and 7.x-5.x before 7.x-5.4 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the breadcrumb separator field. Vulnerabilidad de tipo Cross-Site Scripting (XSS) en la función zen_breadcrumb en el archivo template.php en el tema Zen versiones 6.x-1.x, versiones 7.x-3.x anteriores a la versión 7.x-3.2 y versiones 7.x-5.x anteriores a la versión 7.x-5.4 para Drupal, permite a usuarios autenticados remotos con el permiso "administer themes" para inyectar script web o HTML arbitrario por medio del campo breadcrumb separator. • http://seclists.org/fulldisclosure/2013/Aug/226 http://www.madirish.net/?article=452 http://www.openwall.com/lists/oss-security/2013/08/22/2 http://www.securityfocus.com/bid/61922 https://drupal.org/node/2071055 https://drupal.org/node/2071065 https://drupal.org/node/2071157 https://drupal.org/node/754000 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 6EXPL: 0CVE-2012-2710
https://notcve.org/view.php?id=CVE-2012-2710
Cross-site scripting (XSS) vulnerability in the Zen module 6.x-1.x before 6.x-1.1 for Drupal, when "Append the content title to the end of the breadcrumb" is enabled, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Zen v6.x-1.x anterior a v6.x-1.1 para Drupal, cuando "Append the content title to the end of the breadcrumb" está habilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del "content title" en breadcrumb. • http://drupal.org/node/1585960 http://drupal.org/node/628480 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.securityfocus.com/bid/53573 https://exchange.xforce.ibmcloud.com/vulnerabilities/75711 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •