CVSS: 7.5EPSS: 0%CPEs: 31EXPL: 0CVE-2010-2352
https://notcve.org/view.php?id=CVE-2010-2352
21 Jun 2010 — The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes. El módulo "Node Reference" (referencia de nodo) en el módulo "Content Construction Kit" (CCK o kit de construcción de contenido) v5.x en versiones anteriores a la v5.x-1.11 y v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso an... • http://drupal.org/node/829566 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 0CVE-2008-6972
https://notcve.org/view.php?id=CVE-2008-6972
13 Aug 2009 — Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings. Vulnerabilidad múltiple de ejecución de secuencias de comandos en sitios cruzados - XSS - en Drupal Content Construction Kit (CCK) v5.x hasta v5.x-1.8 permite a los usuarios remotos autenticados con permisos "ad... • http://drupal.org/node/304093 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •