Search criteria
9 vulnerabilities found for cck by yves_chedemois
FKIE_CVE-2010-2353
Vulnerability from fkie_nvd - Published: 2010-06-21 19:30 - Updated: 2025-04-11 00:51
Severity ?
Summary
The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| drupal | drupal | * | |
| yves_chedemois | cck | 6.x-1.0-alpha | |
| yves_chedemois | cck | 6.x-1.x-dev | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.0 | |
| yves_chedemois | cck | 6.x-2.1 | |
| yves_chedemois | cck | 6.x-2.2 | |
| yves_chedemois | cck | 6.x-2.3 | |
| yves_chedemois | cck | 6.x-2.4 | |
| yves_chedemois | cck | 6.x-2.5 | |
| yves_chedemois | cck | 6.x-2.6 | |
| yves_chedemois | cck | 6.x-2.x-dev | |
| yves_chedemois | cck | 6.x-3.x-dev |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-1.0-alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "8CE8ED07-644D-4B7A-9D25-31846C73B16C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-1.x-dev:*:*:*:*:*:*:*",
"matchCriteriaId": "894AAB4C-0687-49FF-80D2-07733232C86E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9981BCE7-4563-4B81-94D7-E15CC7A949C0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "4DE0DF1B-BD55-4BE0-82E5-D6C8F4DB0ED2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "7212E3AC-0707-4C73-BCB8-ECB387621371",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc10:*:*:*:*:*:*",
"matchCriteriaId": "1CBF8E73-7EBC-400E-8045-C89A2400C346",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F091E8C8-ECB2-4CC9-A692-DFD50FAFE0D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5C2D28B8-26B4-4965-95A5-F2CE0CE6C897",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "1B76DBD4-1AAB-4B2D-AC67-606CD9FD6209",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "7B25EE03-5D36-499A-BA45-C5FDD09144DE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "F3A7B8CE-4D89-40E3-8717-9CA43CA227DD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "6E6A0133-B19E-4C9F-ACD3-DBC327722B28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "A2675E82-5546-405A-B1E8-2B656E49A903",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.0:rc9:*:*:*:*:*:*",
"matchCriteriaId": "7AF2DABF-D278-4AC4-B1A1-4CA5E6782695",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "64EA01B6-78C1-4244-8E9E-3E38F99A9C58",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "5A8FFBDF-CC67-409C-9AA4-965998EE1D5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "325695A4-AC8F-42E3-A817-C39D002DBCB9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "54D00828-64FD-4068-8CD7-04D2BCE5AC84",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "13EDA2FA-C962-4F58-BA3D-9F8FFF801D9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "1F8EA159-92F4-4CEA-A117-0BFD07179357",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-2.x-dev:*:*:*:*:*:*:*",
"matchCriteriaId": "578E1219-B38F-4166-923D-FC48E8558707",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:6.x-3.x-dev:*:*:*:*:*:*:*",
"matchCriteriaId": "B8FC11CA-4FEB-4593-A43F-5711E5611D6D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes."
},
{
"lang": "es",
"value": "El m\u00f3dulo \"Node Reference\" (referencia de nodo) en el m\u00f3dulo \"Content Construction Kit\" (CCK o kit de construcci\u00f3n de contenido) v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso para el campo \"source\" (fuente) en la URL de administraci\u00f3n para la funcionalidad autocompletar (autocomplete widget), lo que permite a atacantes remotos descubrir t\u00edtulos e IDs de los nodos controlados.\r\n"
}
],
"id": "CVE-2010-2353",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-06-21T19:30:02.180",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://drupal.org/node/829566"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/65615"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40243"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/40318"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://drupal.org/node/829566"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/65615"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/40318"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2010-2352
Vulnerability from fkie_nvd - Published: 2010-06-21 19:30 - Updated: 2025-04-11 00:51
Severity ?
Summary
The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| karen_stevenson | cck | 5.x-1.0 | |
| karen_stevenson | cck | 5.x-1.1 | |
| karen_stevenson | cck | 5.x-1.2 | |
| karen_stevenson | cck | 5.x-1.3 | |
| karen_stevenson | cck | 5.x-1.7 | |
| karen_stevenson | cck | 5.x-1.x | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.0 | |
| karen_stevenson | cck | 6.x-2.1 | |
| karen_stevenson | cck | 6.x-2.2 | |
| karen_stevenson | cck | 6.x-2.3 | |
| karen_stevenson | cck | 6.x-2.4 | |
| karen_stevenson | cck | 6.x-2.5 | |
| karen_stevenson | cck | 6.x-2.6 | |
| yves_chedemois | cck | 5.x-1.4 | |
| yves_chedemois | cck | 5.x-1.5 | |
| yves_chedemois | cck | 5.x-1.6 | |
| yves_chedemois | cck | 5.x-1.6-1 | |
| yves_chedemois | cck | 5.x-1.8 | |
| yves_chedemois | cck | 5.x-1.9 | |
| yves_chedemois | cck | 5.x-1.10 | |
| drupal | drupal | * |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "ACFB8940-FEC5-4182-950A-A82864AE2B5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2215B4E1-902D-4589-8F9F-B6314AE52E3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "970B9EFC-00F4-4202-95AF-825A4BF29878",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "25365C2D-66D9-4A50-926B-774B37EE2482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "74A1E260-E3E5-403B-81BB-490F4324D6D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.x:dev:*:*:*:*:*:*",
"matchCriteriaId": "1C1428DC-4804-4E72-97DE-FD80B935F354",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "53937A14-F35C-4BF5-AB66-CFBFE876BF3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "83305C7E-283C-4AE5-8670-3B7AC1D86D55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc10:*:*:*:*:*:*",
"matchCriteriaId": "BAB7CAB6-0542-4F13-9E87-7070B4FB0AA5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "C9F1BF59-C912-4CCC-A261-6F796E560D29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "C38E407F-DF69-4ED1-896C-789CD37EF0FC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "D4F75B7B-F942-4D75-A218-23176E82BBD3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "727FA600-C339-433B-9D54-D55F59B65D97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "389C0544-AFCA-4E6C-B868-C7DDC8748642",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "595830E5-193A-4FFB-99B2-6AB1C40B532C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "4925EAD0-27D2-407F-9810-7503E4509780",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.0:rc9:*:*:*:*:*:*",
"matchCriteriaId": "BE0C8B8E-8B4C-4BB2-93D3-04EA07425062",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1C976E29-4FC9-4A6E-B2B0-89B55BD18545",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8A4B0CF5-5698-49B2-91EF-CA2708C01FA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "741FB3EF-AB63-4FD2-93D4-58CDF76F2E5F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6B828690-1068-4F8F-9A0B-CFFF3128E6A7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "7D847B15-ABD3-42B7-B205-310655D58C4D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:6.x-2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "78C411F5-19C9-4D0B-B772-CFF9C090213A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D1134889-22DA-4829-B157-AAC47883EFD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "32D617BA-6060-4AE8-BF91-EC46D79978A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "687DDBBA-C4C4-4094-B06B-5B1B8C46D2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.6-1:*:*:*:*:*:*:*",
"matchCriteriaId": "850E6DE9-2D84-4A2F-BFFE-589FC5563791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "94A3AD40-AEAF-4FAC-9B72-5F83CD072612",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "E1899880-FFA0-458E-8EA7-7E26E225598F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "A86FD201-3427-4DB8-ABF9-52372380255B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes."
},
{
"lang": "es",
"value": "El m\u00f3dulo \"Node Reference\" (referencia de nodo) en el m\u00f3dulo \"Content Construction Kit\" (CCK o kit de construcci\u00f3n de contenido) v5.x en versiones anteriores a la v5.x-1.11 y v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso antes de mostrar los nodos referenciados, lo que permite a atacantes remotos leer los nodos controlados."
}
],
"id": "CVE-2010-2352",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2010-06-21T19:30:02.147",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://drupal.org/node/829566"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/65615"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40243"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/40318"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://drupal.org/node/829566"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/65615"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/40243"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/40318"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2008-6972
Vulnerability from fkie_nvd - Published: 2009-08-13 16:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| drupal | drupal | * | |
| karen_stevenson | cck | 5.x-1.0-beta | |
| karen_stevenson | cck | 5.x-1.1 | |
| karen_stevenson | cck | 5.x-1.2 | |
| karen_stevenson | cck | 5.x-1.3 | |
| karen_stevenson | cck | 5.x-1.7 | |
| karen_stevenson | cck | 5.x-1.x-dev | |
| yves_chedemois | cck | 5.x-1.4 | |
| yves_chedemois | cck | 5.x-1.5 | |
| yves_chedemois | cck | 5.x-1.6 | |
| yves_chedemois | cck | 5.x-1.6-1 | |
| yves_chedemois | cck | 5.x-1.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.0-beta:*:*:*:*:*:*:*",
"matchCriteriaId": "2E5BFC44-CC70-4F5A-95DF-2A8B4E7FF901",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "2215B4E1-902D-4589-8F9F-B6314AE52E3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "970B9EFC-00F4-4202-95AF-825A4BF29878",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "25365C2D-66D9-4A50-926B-774B37EE2482",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "74A1E260-E3E5-403B-81BB-490F4324D6D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:karen_stevenson:cck:5.x-1.x-dev:*:*:*:*:*:*:*",
"matchCriteriaId": "3A7501B8-CFC0-4909-9DAB-0B8E78A9B14E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "D1134889-22DA-4829-B157-AAC47883EFD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "32D617BA-6060-4AE8-BF91-EC46D79978A4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "687DDBBA-C4C4-4094-B06B-5B1B8C46D2AC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.6-1:*:*:*:*:*:*:*",
"matchCriteriaId": "850E6DE9-2D84-4A2F-BFFE-589FC5563791",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:yves_chedemois:cck:5.x-1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "94A3AD40-AEAF-4FAC-9B72-5F83CD072612",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with \"administer content\" permissions to inject arbitrary web script or HTML via the (1) \"field label,\" (2) \"help text,\" or (3) \"allowed values\" settings."
},
{
"lang": "es",
"value": "Vulnerabilidad m\u00faltiple de ejecuci\u00f3n de secuencias de comandos en sitios cruzados - XSS - en Drupal Content Construction Kit (CCK) v5.x hasta v5.x-1.8 permite a los usuarios remotos autenticados con permisos \"administrar contenido\" inyectar arbitrariamente una secuencia de comandos web o HTML a trav\u00e9s de los par\u00e1metros (1) \"field label,\" (2) \"help text,\" o (3) \"allowed values\"."
}
],
"id": "CVE-2008-6972",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 6.8,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-08-13T16:30:01.233",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://drupal.org/node/304093"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/47929"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31757"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/31027"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://drupal.org/node/304093"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/47929"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/31757"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/31027"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2010-2353 (GCVE-0-2010-2353)
Vulnerability from cvelistv5 – Published: 2010-06-21 19:00 – Updated: 2024-08-07 02:32
VLAI?
Summary
The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2353",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65615",
"refsource": "OSVDB",
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40243"
},
{
"name": "http://drupal.org/node/829566",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2353",
"datePublished": "2010-06-21T19:00:00",
"dateReserved": "2010-06-21T00:00:00",
"dateUpdated": "2024-08-07T02:32:16.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2352 (GCVE-0-2010-2352)
Vulnerability from cvelistv5 – Published: 2010-06-21 19:00 – Updated: 2024-08-07 02:32
VLAI?
Summary
The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.379Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2352",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65615",
"refsource": "OSVDB",
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40243"
},
{
"name": "http://drupal.org/node/829566",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2352",
"datePublished": "2010-06-21T19:00:00",
"dateReserved": "2010-06-21T00:00:00",
"dateUpdated": "2024-08-07T02:32:16.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-6972 (GCVE-0-2008-6972)
Vulnerability from cvelistv5 – Published: 2009-08-13 16:00 – Updated: 2024-08-07 11:49
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T11:49:02.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cck-multiple-fields-xss(44915)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
},
{
"name": "47929",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/47929"
},
{
"name": "31757",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31757"
},
{
"name": "31027",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/31027"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/304093"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-09-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with \"administer content\" permissions to inject arbitrary web script or HTML via the (1) \"field label,\" (2) \"help text,\" or (3) \"allowed values\" settings."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "cck-multiple-fields-xss(44915)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
},
{
"name": "47929",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/47929"
},
{
"name": "31757",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31757"
},
{
"name": "31027",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/31027"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/304093"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-6972",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with \"administer content\" permissions to inject arbitrary web script or HTML via the (1) \"field label,\" (2) \"help text,\" or (3) \"allowed values\" settings."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "cck-multiple-fields-xss(44915)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
},
{
"name": "47929",
"refsource": "OSVDB",
"url": "http://osvdb.org/47929"
},
{
"name": "31757",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31757"
},
{
"name": "31027",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/31027"
},
{
"name": "http://drupal.org/node/304093",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/304093"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-6972",
"datePublished": "2009-08-13T16:00:00",
"dateReserved": "2009-08-13T00:00:00",
"dateUpdated": "2024-08-07T11:49:02.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2353 (GCVE-0-2010-2353)
Vulnerability from nvd – Published: 2010-06-21 19:00 – Updated: 2024-08-07 02:32
VLAI?
Summary
The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.371Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2353",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65615",
"refsource": "OSVDB",
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40243"
},
{
"name": "http://drupal.org/node/829566",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2353",
"datePublished": "2010-06-21T19:00:00",
"dateReserved": "2010-06-21T00:00:00",
"dateUpdated": "2024-08-07T02:32:16.371Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2010-2352 (GCVE-0-2010-2352)
Vulnerability from nvd – Published: 2010-06-21 19:00 – Updated: 2024-08-07 02:32
VLAI?
Summary
The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T02:32:16.379Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-06-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "65615",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40243"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2010-2352",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Node Reference module in Content Construction Kit (CCK) module 5.x before 5.x-1.11 and 6.x before 6.x-2.7 for Drupal does not perform access checks before displaying referenced nodes, which allows remote attackers to read controlled nodes."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "65615",
"refsource": "OSVDB",
"url": "http://osvdb.org/65615"
},
{
"name": "40243",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40243"
},
{
"name": "http://drupal.org/node/829566",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/829566"
},
{
"name": "FEDORA-2010-10127",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043100.html"
},
{
"name": "FEDORA-2010-10200",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043191.html"
},
{
"name": "ADV-2010-1546",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2010/1546"
},
{
"name": "40318",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/40318"
},
{
"name": "FEDORA-2010-10176",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2010-June/043172.html"
},
{
"name": "cck-noderef-info-disc(59515)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/59515"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2010-2352",
"datePublished": "2010-06-21T19:00:00",
"dateReserved": "2010-06-21T00:00:00",
"dateUpdated": "2024-08-07T02:32:16.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2008-6972 (GCVE-0-2008-6972)
Vulnerability from nvd – Published: 2009-08-13 16:00 – Updated: 2024-08-07 11:49
VLAI?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T11:49:02.567Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "cck-multiple-fields-xss(44915)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
},
{
"name": "47929",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/47929"
},
{
"name": "31757",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/31757"
},
{
"name": "31027",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/31027"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://drupal.org/node/304093"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-09-04T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with \"administer content\" permissions to inject arbitrary web script or HTML via the (1) \"field label,\" (2) \"help text,\" or (3) \"allowed values\" settings."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "cck-multiple-fields-xss(44915)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
},
{
"name": "47929",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/47929"
},
{
"name": "31757",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/31757"
},
{
"name": "31027",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/31027"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://drupal.org/node/304093"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-6972",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with \"administer content\" permissions to inject arbitrary web script or HTML via the (1) \"field label,\" (2) \"help text,\" or (3) \"allowed values\" settings."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "cck-multiple-fields-xss(44915)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44915"
},
{
"name": "47929",
"refsource": "OSVDB",
"url": "http://osvdb.org/47929"
},
{
"name": "31757",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/31757"
},
{
"name": "31027",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/31027"
},
{
"name": "http://drupal.org/node/304093",
"refsource": "CONFIRM",
"url": "http://drupal.org/node/304093"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-6972",
"datePublished": "2009-08-13T16:00:00",
"dateReserved": "2009-08-13T00:00:00",
"dateUpdated": "2024-08-07T11:49:02.567Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}