36 matches found
Drupal Node Access User Reference模块访问绕过漏洞
Bugtraq ID:60211 CVE ID:CVE-2013-2123 Drupal是一个基于PHP语言编写的开发型CMF（内容管理框架）。 Drupal Node Access User Reference模块允许对坐着，引用用户和非引用用户分配不同的访问权限。当作者创建包含用户引用字段的内容，并坐着用户账户不就被删除后，该作者创建的内容可被匿名用户编辑。 0 Drupal Node Access User Reference 6.x Drupal Node Access User Reference 7.x 厂商解决方案 Drupal Node Access User...
SA-CONTRIB-2013-049 - Node access user reference - Access Bypass
This module allows different access permissions to be given to authors, referenced users and non-referenced users. When an author has created content containing a user reference field with author update/delete grants enabled and the author's user account is later deleted, content created by them...
Drupal's <= v6.x-1.0 Realname User Reference Widget contributed module
Exploit for unknown platform in category web applications ====================================================================== Drupal's Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easily...
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module (version 6.x-1.0)
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella [email protected] Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a...
Drupal Realname User Reference Information Disclosure
Information disclosure vulnerability in Drupal's Realname User Reference Widget contributed module version 6.x-1.0 Discovered by Martin Barbella Description of Vulnerability: ----------------------------- Drupal is a free software package that allows an individual or a community of users to easil...
CVE-2009-1507
The vulnerability CVE-2009-1507 affects the Drupal Node Access User Reference module (5.x prior to 5.x-2.0-beta4 and 6.x prior to 6.x-2.0-beta6). The module interprets an empty CCK user reference as the anonymous user, potentially bypassing access controls to read or modify a node. Remediation: u...
CVE-2009-1507
The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node...
CVE-2009-1507: Undefined Security Weakness
The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node...
SA-CONTRIB-2009-024 - Node Access User Reference - Access Bypass
Node Access User Reference enables administrators to automatically grant node access view, update, or delete to a node where the user is referenced by CCK user reference. When such a field is saved with an empty value, Node Access User Reference mistakes this for a reference to the anonymous user...
FreeBSD : drupal6-cck -- XSS (03d22656-2690-11de-8226-0030843d3802)
Drupal CCK plugin developer reports : The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate...
CVE-2009-1069
Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...
CVE-2009-1069
Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...
CVE-2009-1069: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the node edit form feature in Drupal Content Construction Kit CCK 6.x before 6.x-2.2, a module for Drupal, allow remote attackers to inject arbitrary web script or HTML via the 1 titles of candidate referenced nodes in the Node reference...
drupal6-cck -- cross-site scripting
Drupal CCK plugin developer reports: The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate...
SA-CONTRIB-2009-013 CCK - Cross site scripting
The Node reference and User reference sub-modules, which are part of the Content Construction Kit CCK project, lets administrators define node fields that are references to other nodes or to users. When displaying a node edit form, the titles of candidate referenced nodes or names of candidate...