CVSS: 5.4EPSS: 0%CPEs: 59EXPL: 0CVE-2013-4380
https://notcve.org/view.php?id=CVE-2013-4380
20 May 2014 — Cross-site scripting (XSS) vulnerability in the MediaFront module 6.x-1.x before 6.x-1.6, 7.x-1.x before 7.x-1.6, and 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer mediafront" permission to inject arbitrary web script or HTML via the preset settings. Vulnerabilidad de XSS en el módulo MediaFront 6.x-1.x anterior a 6.x-1.6, 7.x-1.x anterior a 7.x-1.6 y 7.x-2.x anterior a 7.x-2.1 para Drupal permite a usuarios remotos autenticados con el permiso 'administrar mediafro... • http://www.openwall.com/lists/oss-security/2013/09/27/6 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 20EXPL: 2CVE-2012-1647
https://notcve.org/view.php?id=CVE-2012-1647
28 Aug 2012 — Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via (1) $_SERVER['HTTP_HOST'] or (2) $_SERVER['SCRIPT_NAME'] to players/osmplayer/player/OSMPlayer.php, (3) playlist parameter to players/osmplayer/player/getplaylist.php, and possibly other vectors related to $_SESSION. Múltiples vulnerabilidade... • http://drupalcode.org/project/mediafront.git/commitdiff/6300750 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •