SA-CONTRIB-2009-018 - Feed element mapper - Cross site scripting

Feed element mapper is an Add-on module for FeedAPI that maps elements on a feed item such as tags or the author name to taxonomy or CCK fields. These mappings are configurable by point and click. The module does not escape content titles enabling malicious users to insert arbitrary HTML and...

CVE-2009-1069

Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...

CVE-2009-1069

Drupal CCK for Drupal 6.x contains XSS in node and user reference sub-modules (node titles and user names on the node edit form). Root cause: insufficient filtering of candidate references, enabling injection of arbitrary script/HTML. Affected: Drupal Content Construction Kit (CCK) 6.x prior to 6...

SA-CONTRIB-2009-014 - CCK Field Privacy - Access Bypass

CCK Field Privacy was incorrectly updated for the Drupal 6.x menu system in such a way that the intended access controls for the administrative pages are by-passed for unprivileged users. This may allow users to change permissions on fields and lead to exposure of private content. Versions affect...

drupal6-cck -- cross-site scripting

Drupal CCK plugin developer reports: The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate...

Fedora 9 : drupal-cck-6.x.2.2-1.fc9 (2009-2873)

Fixes DRUPAL-SA-CONTRIB-2009-013 - XSS issue: http://drupal.org/node/406520 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introduci...

[SECURITY] Fedora 9 Update: drupal-cck-6.x.2.2-1.fc9

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...

[SECURITY] Fedora 10 Update: drupal-cck-6.x.2.2-1.fc10

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...

SA-CONTRIB-2009-013 CCK - Cross site scripting

The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate...

Drupal Viewfield Module Cross Site Scripting

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Yes, it's yet another CCK related module with XSS vulnerabilities. It's lame, but it should be reported since the Drupal security team has already made an announcement about the issue in these modules. Drupal security and module maintainer have been...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative interface in Drupal Content Construction Kit CCK 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via 1 field...

CVE-2008-6229

Cross-site scripting XSS vulnerability in the administrative interface in Drupal Content Construction Kit CCK 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via 1 field...

CVE-2008-6229

CVE-2008-6229 is a browser-based XSS vulnerability in the Drupal Content Construction Kit (CCK) module. The issue affects Drupal CCK 5.x prior to 5.x-1.10 and 6.x prior to 6.x-2.0, where remote authenticated users with the admin:ister content permission can inject arbitrary script/HTML via (1) fi...

Fedora Update for drupal-cck FEDORA-2008-9479

Check for the Version of drupal-cck OpenVAS Vulnerability Test Fedora Update for drupal-cck FEDORA-2008-9479 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for drupal-cck FEDORA-2008-9479

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for drupal-cck FEDORA-2008-10000

Check for the Version of drupal-cck OpenVAS Vulnerability Test Fedora Update for drupal-cck FEDORA-2008-10000 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for drupal-cck FEDORA-2008-10000

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[SECURITY] Fedora 10 Update: drupal-cck-6.x.2.0-3.fc10

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...

[SECURITY] Fedora 9 Update: drupal-cck-6.x.2.0-3.fc9

The Content Construction Kit allows you create and customize fields using a web browser. The 4.7x version of CCK creates custom content types and allows you to add custom fields to them. In Drupal 5.x custom content types can be created in core, and CCK allows you to add custom fields to any...

Drupal Content Construction Kit模块HTML注入漏洞

BUGTRAQ ID: 32136 Content Construction Kit（CCK）是开源内容管理系统Drupal所使用的模块，用于向节点添加自定义字段。 CCK模块的管理接口没有正确地过滤某些字段标记和content-type名称便显示了上述内容，拥有administer content权限的用户可以通过提交恶意请求向页面中注入任意HTML和脚本代码。成功利用这个漏洞的攻击者可以获得完全的管理访问权限。 Drupal CCK 6.x Drupal CCK 5.x Drupal ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...