CVE-2009-1069

Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...

CVE-2009-1069

Drupal CCK for Drupal 6.x contains XSS in node and user reference sub-modules (node titles and user names on the node edit form). Root cause: insufficient filtering of candidate references, enabling injection of arbitrary script/HTML. Affected: Drupal Content Construction Kit (CCK) 6.x prior to 6...

SA-CONTRIB-2009-014 - CCK Field Privacy - Access Bypass

CCK Field Privacy was incorrectly updated for the Drupal 6.x menu system in such a way that the intended access controls for the administrative pages are by-passed for unprivileged users. This may allow users to change permissions on fields and lead to exposure of private content. Versions affect...

drupal6-cck -- cross-site scripting

Drupal CCK plugin developer reports: The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate...

Fedora 9 : drupal-cck-6.x.2.2-1.fc9 (2009-2873)

Fixes DRUPAL-SA-CONTRIB-2009-013 - XSS issue: http://drupal.org/node/406520 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introduci...

[SECURITY] Fedora 9 Update: drupal-cck-6.x.2.2-1.fc9

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...

[SECURITY] Fedora 10 Update: drupal-cck-6.x.2.2-1.fc10

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...

SA-CONTRIB-2009-013 CCK - Cross site scripting

The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate...

Drupal Viewfield Module Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yes, it's yet another CCK related module with XSS vulnerabilities. It's lame, but it should be reported since the Drupal security team has already made an announcement about the issue in these modules. Drupal security and module maintainer have been...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative interface in Drupal Content Construction Kit CCK 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via 1 field...

CVE-2008-6229

Cross-site scripting XSS vulnerability in the administrative interface in Drupal Content Construction Kit CCK 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via 1 field...

CVE-2008-6229

CVE-2008-6229 is a browser-based XSS vulnerability in the Drupal Content Construction Kit (CCK) module. The issue affects Drupal CCK 5.x prior to 5.x-1.10 and 6.x prior to 6.x-2.0, where remote authenticated users with the admin:ister content permission can inject arbitrary script/HTML via (1) fi...

CVE-2008-6229: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the administrative interface in Drupal Content Construction Kit CCK 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via 1 field...

Fedora Update for drupal-cck FEDORA-2008-9479

Check for the Version of drupal-cck OpenVAS Vulnerability Test Fedora Update for drupal-cck FEDORA-2008-9479 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for drupal-cck FEDORA-2008-9479

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for drupal-cck FEDORA-2008-10000

Check for the Version of drupal-cck OpenVAS Vulnerability Test Fedora Update for drupal-cck FEDORA-2008-10000 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for drupal-cck FEDORA-2008-10000

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

CVE-2008-6020: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an exposed filter on CCK text fields."...

[SECURITY] Fedora 10 Update: drupal-cck-6.x.2.0-3.fc10

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...

[SECURITY] Fedora 9 Update: drupal-cck-6.x.2.0-3.fc9

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...