Drupal Realname User Reference Information Disclosure

Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easil...

Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module (version 6.x-1.0)

Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella [email protected] Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a...

CVE-2009-1507

The vulnerability CVE-2009-1507 affects the Drupal Node Access User Reference module (5.x prior to 5.x-2.0-beta4 and 6.x prior to 6.x-2.0-beta6). The module interprets an empty CCK user reference as the anonymous user, potentially bypassing access controls to read or modify a node. Remediation: u...

CVE-2009-1507: Undefined Security Weakness

The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node...

SA-CONTRIB-2009-024 - Node Access User Reference - Access Bypass

Node Access User Reference enables administrators to automatically grant node access view, update, or delete to a node where the user is referenced by CCK user reference. When such a field is saved with an empty value, Node Access User Reference mistakes this for a reference to the anonymous user...

FreeBSD : drupal6-cck -- XSS (03d22656-2690-11de-8226-0030843d3802)

Drupal CCK plugin developer reports : The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate...

CVE-2009-1069

Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...

CVE-2009-1069: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...

drupal6-cck -- cross-site scripting

Drupal CCK plugin developer reports: The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate...

SA-CONTRIB-2009-013 CCK - Cross site scripting

The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate...