CVE-2012-5538

Cross-site scripting XSS vulnerability in the FileField Sources module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.6 for Drupal, when the field has "Reference existing" source enabled, allows remote authenticated users to inject arbitrary web script or HTML via the filename of an uploaded fil...

SA-CONTRIB-2012-147 - FileField Sources - Cross Site Scripting (XSS)

The Drupal FileField module lets you upload files from your computer through a CCK field. The FileField Sources module expands on this ability by allowing you to select new or existing files through additional means. The FileField Sources module contains a persistent cross site scripting XSS...

Drupal FileField Source Module < 6.x-1.2 Arbitrary Code Execution

Binary data 5636.prm...

SA-CONTRIB-2010-081 - FileField Sources - Arbitrary Code Execution

The FileField Sources module expands on the abilities of FileField, allowing users to select new or existing files through additional means, including: Reuse of existing files through an autocomplete textfield or IMCE, or transfering files directly from remote servers. The module does not sanitiz...

CVE-2010-1958

Cross-site scripting XSS vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name...

CVE-2010-1958

Cross-site scripting XSS vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name...

Cross site scripting

Cross-site scripting XSS vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name...

CVE-2010-1958

The CVE-2010-1958 issue affects Drupal’s FileField module (5.x before 5.x-2.5 and 6.x before 6.x-3.4). A remote authenticated user with create/edit permissions and an enabled Path to File/URL to File display can inject arbitrary script/HTML via the file name (filepath parameter), i.e., an XSS vul...

CVE-2010-1958

Cross-site scripting XSS vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name...

SA-CONTRIB-2010-066 - FileField - Cross Site Scripting

FileField module integrates with the Content Construction Kit to provide a file upload field. It also integrates with the Views and Token modules. The module does not sanitize some of the user-supplied data before displaying it for Drupal 6.x-3.x only, or before adding it to tokens both 5.x-2.x a...

SA-CONTRIB-2010-040: FileField - Access Bypass

FileField provides a file upload field for CCK, allowing files to be attached to a node. FileField intends to set a default extension of "txt" for all new fields, but may actually save an empty string allowing all extensions if an administrator does not save the field configuration page after...

Design/Logic Flaw

The filefieldfiledownload function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors...

CVE-2009-3781

The filefieldfiledownload function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors...

CVE-2009-3781

The filefieldfiledownload function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors...

CVE-2009-3781

The issue concerns the Drupal FileField 6.x-3.1 module, where the function filefield_file_download does not correctly enforce node-access permissions for Drupal core private files. This permits remote attackers to access unauthorized files via unspecified vectors. Root cause: missing access check...

SA-CONTRIB-2009-082 - Filefield module access bypass

The FileField module allows users to upload files through an AJAX-upload widget that can be added to content types through CCK. In the 3.1 version of FileField, the module would not restrict access to files based on node-access permissions when using Drupal core's private file system. Versions...