RSS   Vulnerabilities for 'Filefield'   RSS

2010-06-21
 
CVE-2010-1958

CWE-79
 

 
Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter).

 
2009-10-26
 
CVE-2009-3781

CWE-264
 

 
The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.

 


Copyright 2024, cxsecurity.com

 

Back to Top