EUVD-2009-1340

Malware in sbrugna...

Path traversal

The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended access restrictions and read comments by using the autocomplete path...

CVE-2009-4520

The vulnerability CVE-2009-4520 affects the Drupal CCK Comment Reference module. Affected versions are 5.x before 5.x-1.2 and 6.x before 6.x-1.3. The issue allows remote attackers to bypass access controls and read comments by abusing the module’s autocomplete path. Remediation requires upgrading...

CVE-2009-4520

The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to bypass intended access restrictions and read comments by using the autocomplete path...

SA-CONTRIB-2009-083 - CCK Comment Reference - Access Bypass

The CCK Comment Reference module enables administrators to define node fields that are references to comments. Users can access comments through the autocomplete path that the module provides even if they don't have access to read comments. Versions affected CCK Comment Reference module versions...

CVE-2009-1342

Cross-site scripting XSS vulnerability in the CCK comment reference module 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via certain comment titles associated with a node edit form...

CVE-2009-1342

Cross-site scripting XSS vulnerability in the CCK comment reference module 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via certain comment titles associated with a node edit form...

CVE-2009-1342

The CVE-2009-1342 issue concerns the Drupal CCK comment reference module (6.x) prior to version 6.x-1.2. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML through certain comment titles associated with a node edit form. No e...

SA-CONTRIB-2009-021 CCK comment reference - Cross site scripting

CCK comment reference project, lets administrators define node fields that are references to comments. When displaying a node edit form, the titles of candidate referenced comments are not properly filtered, allowing malicious users to inject arbitrary code on those pages. Such a cross site...