Show filters
14 Total Results
Displaying 11-14 of 14
Sort by:
Attacker Value
Unknown
CVE-2015-6661
Disclosure Date: August 24, 2015 (last updated October 05, 2023)
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
0
Attacker Value
Unknown
CVE-2015-6660
Disclosure Date: August 24, 2015 (last updated October 05, 2023)
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
0
Attacker Value
Unknown
CVE-2015-6658
Disclosure Date: August 24, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
0
Attacker Value
Unknown
CVE-2015-3234
Disclosure Date: June 22, 2015 (last updated October 05, 2023)
The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
0
