CVSS: 5.0EPSS: 0%CPEs: 19EXPL: 1CVE-2012-2704
https://notcve.org/view.php?id=CVE-2012-2704
The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attackers to obtain sensitive site configuration information that is specified by the $conf variable in settings.php. El módulo "Advertisement" v6.x-2.x antes de v6.x-2.3 para Drupal no restringe adecuadamente el acceso a depurar la información, lo que permite a atacantes remotos obtener información sensible de la configuración del sitio que se encuentra en la variable $conf en settings.php. • http://drupal.org/node/1585544 http://drupalcode.org/project/ad.git/commitdiff/c2ffab2 http://www.openwall.com/lists/oss-security/2012/06/14/3 https://drupal.org/node/1580376 https://exchange.xforce.ibmcloud.com/vulnerabilities/75719 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.6EPSS: 0%CPEs: 18EXPL: 1CVE-2012-2703
https://notcve.org/view.php?id=CVE-2012-2703
Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo Advertisement v6.x-2.x anterior a v6.x-2.3 para Drupal, cuando el modo de depuración está habilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores relacionados con el "variable $ conf en settings.php ". • http://drupal.org/node/1585544 http://drupalcode.org/project/ad.git/commitdiff/4337f34 http://www.openwall.com/lists/oss-security/2012/06/14/3 https://drupal.org/node/1580376 https://exchange.xforce.ibmcloud.com/vulnerabilities/75718 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •