CVE

Id
43281  
CVE No.
CVE-2010-0697  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users, with create content and upload file permissions, to inject arbitrary web script or HTML via the file name of an uploaded file.  
Phase
Assigned (20100223)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
471522 43281 CVE-2010-0697 CONFIRM:http://drupal.org/node/711072  View
471523 43281 CVE-2010-0697 CONFIRM:http://drupal.org/node/711074  View
471524 43281 CVE-2010-0697 CONFIRM:http://drupal.org/node/717214  View
471525 43281 CVE-2010-0697 BID:38292  View
471526 43281 CVE-2010-0697 URL:http://www.securityfocus.com/bid/38292  View
471527 43281 CVE-2010-0697 OSVDB:62405  View
471528 43281 CVE-2010-0697 URL:http://osvdb.org/62405  View
471529 43281 CVE-2010-0697 SECUNIA:38633  View
471530 43281 CVE-2010-0697 URL:http://secunia.com/advisories/38633  View
471531 43281 CVE-2010-0697 XF:itweakupload-filenames-xss(56351)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
38740 JVNDB-2010-004525 Newgen Software OmniDocs の ForceChangePassword.jsp における SQL インジェクションの脆弱性 Newgen Software OmniDocs の ForceChangePassword.jsp には、SQL インジェクションの脆弱性が存在します。 CVE-2010-0701 43281 7.5 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-004525.html  View