Show filters
41 Total Results
Displaying 11-20 of 41
Sort by:
Attacker Value
Unknown
CVE-2015-6661
Disclosure Date: August 24, 2015 (last updated October 05, 2023)
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
0
Attacker Value
Unknown
CVE-2015-6660
Disclosure Date: August 24, 2015 (last updated October 05, 2023)
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
0
Attacker Value
Unknown
CVE-2015-6658
Disclosure Date: August 24, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
0
Attacker Value
Unknown
CVE-2015-3234
Disclosure Date: June 22, 2015 (last updated October 05, 2023)
The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
0
Attacker Value
Unknown
CVE-2014-5267
Disclosure Date: September 30, 2014 (last updated October 05, 2023)
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
0
Attacker Value
Unknown
CVE-2014-5266
Disclosure Date: August 18, 2014 (last updated October 05, 2023)
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
0
Attacker Value
Unknown
CVE-2014-5265
Disclosure Date: August 18, 2014 (last updated October 05, 2023)
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
0
Attacker Value
Unknown
CVE-2014-5021
Disclosure Date: July 22, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.
0
Attacker Value
Unknown
CVE-2014-5019
Disclosure Date: July 22, 2014 (last updated October 05, 2023)
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.
0
Attacker Value
Unknown
CVE-2014-1475
Disclosure Date: January 24, 2014 (last updated October 05, 2023)
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
0
