CVE-2012-2703

Cross-site scripting XSS vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php."...

CVE-2012-2703

CVE-2012-2703 describes an XSS vulnerability in the Drupal Advertisement module (versions 6.x-2.x prior to 6.x-2.3). When debug mode is enabled, an attacker could inject arbitrary script/HTML via the $conf variable in settings.php. Affected product: Drupal contributed Advertisement module for 6.x...

SA-CONTRIB-2012-077 - Advertisement - Cross Site Scripting & Information Disclosure

XSS Issue: CVE: CVE-2012-2703. Access bypass: CVE: CVE-2012-2704 This module enables you to serve advertisements, define pools of ads and show certain ads on certain pages. The module could, under certain conditions, expose limited site configuration information and a debugging mode did not...