National Vulnerability Database

National Vulnerability Database

National Vulnerability
Database

Search Results (Refine Search)

Search Parameters:
  • Contains Software Flaws (CVE)
  • CPE Product Version: cpe:/a:john_franklin:advertisement:6.x-2.3:dev
There are 2 matching records.
Vuln ID Summary CVSS Severity
CVE-2012-2704

The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attackers to obtain sensitive site configuration information that is specified by the $conf variable in settings.php.

Published: August 31, 2012; 04:55:00 PM -04:00
    V2: 5.0 MEDIUM
CVE-2012-2703

Cross-site scripting (XSS) vulnerability in the Advertisement module 6.x-2.x before 6.x-2.3 for Drupal, when debug mode is enabled, allows remote attackers to inject arbitrary web script or HTML via vectors related to the "$conf variable in settings.php."

Published: June 26, 2012; 08:55:02 PM -04:00
    V2: 2.6 LOW