sandiego.gov XSS vulnerability

Vulnerable URL: https://www.sandiego.gov/sites/default/files/legacy/coo/2016highlights/bookContent.swf?currentHTMLURL=data:text/html;base64,PHNjcmlwdD5hbGVydCgnT1BFTiBCVUdCT1VOVFknKTwvc2NyaXB0Pg==&cfwaftk=042437002UjFXxFQ2VsadXjZGy4EHwOwvPBs Details: Description| Value ---|--- Patched:| No Latest...

Design/Logic Flaw

An administration page in the NGP COO/CWP Integration crmngp module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors...

CVE-2009-3920

An administration page in the NGP COO/CWP Integration crmngp module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors...

CVE-2009-3919

Cross-site scripting XSS vulnerability in the NGP COO/CWP Integration crmngp module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information."...

CVE-2009-3919

Cross-site scripting XSS vulnerability in the NGP COO/CWP Integration crmngp module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information."...

CVE-2009-3919

CVE-2009-3919 affects Drupal’s NGP COO/CWP Integration (crmngp) 6.x up to 6.x-1.12. It is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified user-supplied information. Remediation: upgrade to 6.x-1.12 or apply the officia...

CVE-2009-3920

The CVE-2009-3920 affects the Drupal NGP COO/CWP Integration (crmngp) module for 6.x, specifically versions prior to 6.x-1.12. The root cause is insufficient access control on an administration page, which allows remote attackers to read log information through unspecified vectors. Exploitation d...

CVE-2009-3920

An administration page in the NGP COO/CWP Integration crmngp module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors...

SA-CONTRIB-2009-094 - NGP COO/CWP Integration (crmngp) - Multiple Vulnerabilities

The NGP COO/CWP Integration module provides Drupal integration with the NGP Software API for efficient campaign management. An administration page did not properly implement access control thereby allowing untrusted users to view module log information. User-supplied information was not filtered ...