Show filters
488 Total Results
Displaying 261-270 of 488
Sort by:
Attacker Value
Unknown
CVE-2012-1590
Disclosure Date: October 01, 2012 (last updated October 05, 2023)
The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page.
0
Attacker Value
Unknown
CVE-2012-1591
Disclosure Date: October 01, 2012 (last updated October 05, 2023)
The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles.
0
Attacker Value
Unknown
CVE-2012-1646
Disclosure Date: September 25, 2012 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module.
0
Attacker Value
Unknown
CVE-2012-2083
Disclosure Date: August 31, 2012 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the fusion_core_preprocess_page function in fusion_core/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter.
0
Attacker Value
Unknown
CVE-2012-1642
Disclosure Date: August 28, 2012 (last updated October 05, 2023)
includes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does not properly enforce access permissions on broken links, which allows remote attackers to obtain sensitive information via unspecified vectors.
0
Attacker Value
Unknown
CVE-2012-2298
Disclosure Date: August 14, 2012 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) "user names in page titles" and (2) "autocomplete callbacks."
0
Attacker Value
Unknown
CVE-2012-2306
Disclosure Date: July 25, 2012 (last updated October 04, 2023)
SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
0
Attacker Value
Unknown
CVE-2012-2718
Disclosure Date: June 21, 2012 (last updated October 04, 2023)
SQL injection vulnerability in the Counter module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "recording visits."
0
Attacker Value
Unknown
CVE-2012-2922
Disclosure Date: May 21, 2012 (last updated October 04, 2023)
The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.
0
Attacker Value
Unknown
CVE-2012-2339
Disclosure Date: May 21, 2012 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "taxonomy information."
0
