3 results (0.003 seconds)

CVSS: 7.5EPSS: 0%CPEs: 31EXPL: 0

CVE-2010-2352

https://notcve.org/view.php?id=CVE-2010-2352

21 Jun 2010 — The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes. El módulo "Node Reference" (referencia de nodo) en el módulo "Content Construction Kit" (CCK o kit de construcción de contenido) v5.x en versiones anteriores a la v5.x-1.11 y v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso an... • http://drupal.org/node/829566 • CWE-20: Improper Input Validation •

CVSS: 5.3EPSS: 0%CPEs: 23EXPL: 0

CVE-2010-2353

https://notcve.org/view.php?id=CVE-2010-2353

21 Jun 2010 — The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes. El módulo "Node Reference" (referencia de nodo) en el módulo "Content Construction Kit" (CCK o kit de construcción de contenido) v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso para el campo "so... • http://drupal.org/node/829566 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 5.4EPSS: 0%CPEs: 12EXPL: 0

CVE-2008-6972

https://notcve.org/view.php?id=CVE-2008-6972

13 Aug 2009 — Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings. Vulnerabilidad múltiple de ejecución de secuencias de comandos en sitios cruzados - XSS - en Drupal Content Construction Kit (CCK) v5.x hasta v5.x-1.8 permite a los usuarios remotos autenticados con permisos "ad... • http://drupal.org/node/304093 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •