CVE

Id
41992  
CVE No.
CVE-2009-4557  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in the Image Assist module 5.x-1.x before 5.x-1.8, 5.x-2.x before 2.0-alpha4, 6.x-1.x before 6.x-1.1, 6.x-2.x before 2.0-alpha4, and 6.x-3.x-dev before 2009-07-15, a module for Drupal, allows remote authenticated users, with image-node creation privileges, to inject arbitrary web script or HTML via a node title.  
Phase
Assigned (20100104)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
460164 41992 CVE-2009-4557 CONFIRM:http://drupal.org/node/520564  View
460165 41992 CVE-2009-4557 BID:35710  View
460166 41992 CVE-2009-4557 URL:http://www.securityfocus.com/bid/35710  View
460167 41992 CVE-2009-4557 OSVDB:55866  View
460168 41992 CVE-2009-4557 URL:http://osvdb.org/55866  View
460169 41992 CVE-2009-4557 SECUNIA:35879  View
460170 41992 CVE-2009-4557 URL:http://secunia.com/advisories/35879  View
460171 41992 CVE-2009-4557 XF:imageassist-node-title-xss(51786)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
39261 JVNDB-2010-005046 WebLeague の Admin/index.php における SQL インジェクションの脆弱性 WebLeague の Admin/index.php には、magic_quotes_gpc が無効になっている際、SQL インジェクションの脆弱性が存在します。 CVE-2009-4561 41992 6.8 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-005046.html  View