Overview 306 matches · 0 in Waratek scope · 0 protected · 12 exploited · 8 CISA KEV · 21 public PoC · 14 EPSS ≥ 0.5
306matches
0in Waratek scope0.0%
0protected0.0%
12exploited3.9%
8CISA KEV2.6%
21public PoC6.9%
14EPSS ≥ 0.54.6%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
10
3.3%
Not applicable
296
96.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
306
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 28 / year
20021
Not applicable1
Medium1
not blocked1
Working exploit published1
20030
20040
20057
Not applicable7
High2
Medium5
not blocked7
Working exploit published2
No public exploit5
200625
Not applicable25
High5
Medium15
Low5
not blocked25
Working exploit published1
No public exploit24
200718
Not applicable18
High3
Medium11
Low4
not blocked18
Working exploit published1
No public exploit17
200828
Not applicable28
High3
Medium22
Low3
not blocked28
No public exploit28
200920
Not applicable20
High2
Medium12
Low6
not blocked20
No public exploit20
20106
Not applicable6
Medium4
Low2
not blocked6
No public exploit6
20112
Not applicable2
High1
Medium1
not blocked2
No public exploit2
201212
Not applicable12
High1
Medium10
Low1
not blocked12
Working exploit published1
No public exploit11
201314
Not applicable14
Medium11
Low3
not blocked14
No public exploit14
201417
Outside Waratek scope1
Not applicable16
High3
Medium12
Low2
not blocked17
Exploited1
Working exploit published1
No public exploit15
201512
Not applicable12
High2
Medium9
Low1
not blocked12
No public exploit12
201620
Outside Waratek scope1
Not applicable19
High10
Medium10
not blocked20
Forecast only1
No public exploit19
20178
Not applicable8
High4
Medium4
not blocked8
No public exploit8
201812
Not applicable12
Critical3
High2
Medium7
not blocked12
Exploited2
Forecast only1
No public exploit9
201920
Outside Waratek scope1
Not applicable19
Critical4
High5
Medium11
not blocked20
Exploited3
Proof of concept only1
No public exploit16
202010
Outside Waratek scope3
Not applicable7
Critical3
High3
Medium4
not blocked10
Exploited4
Proof of concept only1
No public exploit5
202114
Outside Waratek scope3
Not applicable11
Critical1
High5
Medium8
not blocked14
Exploited1
Working exploit published1
Proof of concept only1
No public exploit11
202217
Outside Waratek scope1
Not applicable16
Critical1
High9
Medium7
not blocked17
No public exploit17
20238
Not applicable8
High4
Medium4
not blocked8
No public exploit8
202412
Not applicable12
Critical3
High4
Medium5
not blocked12
Working exploit published1
Proof of concept only1
No public exploit10
202510
Not applicable10
High2
Medium7
Low1
not blocked10
No public exploit10
202613
Not applicable13
Critical1
Medium11
Low1
not blocked13
Exploited1
No public exploit12
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2011-2687 | High | 2011-07-27 | Not applicable | No public exploit | Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table. |
| CVE-2010-3686 | Medium | 2010-09-29 | Not applicable | No public exploit | The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
| CVE-2010-3685 | Medium | 2010-09-29 | Not applicable | No public exploit | The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
| CVE-2010-3091 | Medium | 2010-09-29 | Not applicable | No public exploit | The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. |
| CVE-2010-3094 | Low | 2010-09-21 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the actions feature and the trigger module. |
| CVE-2010-3093 | Low | 2010-09-21 | Not applicable | No public exploit | The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue. |
| CVE-2010-3092 | Medium | 2010-09-21 | Not applicable | No public exploit | The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name. |
| CVE-2009-4371 | Low | 2009-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the (1) Language name in English or (2) Native language name fields in the Custom language form. |
| CVE-2009-4370 | Low | 2009-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly handled in the menu administration overview. |
| CVE-2009-4369 | Low | 2009-12-21 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script or HTML via the contact category name. |
| CVE-2009-4066 | Medium | 2009-11-24 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or (2) unsubscribing to mailing lists. |
| CVE-2009-3479 | Medium | 2009-09-30 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x before 5.x-1.17 and 6.x before 6.x-1.6, a module for Drupal, allows remote attackers, with "create content displayed by the Bibliography module" permissions, to inject arbitrary web script or HTML via a title. |
| CVE-2009-3352 | High | 2009-09-24 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the quota_by_role (Quota by role) module for Drupal have unknown impact and attack vectors. |
| CVE-2009-3156 | Low | 2009-09-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field. |
| CVE-2009-2572 | Medium | 2009-07-22 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes. |
| CVE-2009-2374 | Medium | 2009-07-08 | Not applicable | No public exploit | Drupal 5.x before 5.19 and 6.x before 6.13 does not properly sanitize failed login attempts for pages that contain a sortable table, which includes the username and password in links that can be read from (1) the HTTP referer header of external web sites that are visited from those links or (2) when page caching is enabled, the Drupal page cache. |
| CVE-2009-2373 | Medium | 2009-07-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Forum module in Drupal 6.x before 6.13 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2009-2372 | Medium | 2009-07-08 | Not applicable | No public exploit | Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature. |
| CVE-2009-2035 | Medium | 2009-06-12 | Not applicable | No public exploit | Unspecified vulnerability in Services 6.x before 6.x-0.14, a module for Drupal, when key-based access is enabled, allows remote attackers to read or add keys and access unauthorized services via unspecified vectors. |
| CVE-2009-1844 | Low | 2009-06-01 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject arbitrary web script or HTML via crafted UTF-8 byte sequences that are treated as UTF-7 by Internet Explorer 6 and 7, which are not properly handled in the "HTML exports of books" feature; and (2) allow remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via the help text of an arbitrary vocabulary. NOTE: vector 1 exists because of an incomplete fix for CVE-2009-1575. |
| CVE-2009-1576 | Medium | 2009-05-06 | Not applicable | No public exploit | Unspecified vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows user-assisted remote attackers to obtain sensitive information by tricking victims into visiting the front page of the site with a crafted URL and causing form data to be sent to an attacker-controlled site, possibly related to multiple / (slash) characters that are not properly handled by includes/bootstrap.inc, as demonstrated using the search box. NOTE: this vulnerability can be leveraged to conduct cross-site request forgery (CSRF) attacks. |
| CVE-2009-1575 | Medium | 2009-05-06 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7. |
| CVE-2008-6533 | Medium | 2009-03-26 | Not applicable | No public exploit | Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. |
| CVE-2008-6532 | Medium | 2009-03-26 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database. |
| CVE-2009-1047 | Medium | 2009-03-23 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Send by e-mail module in the "Printer, e-mail and PDF versions" module 5.x before 5.x-4.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via vectors involving outbound HTML e-mail. |
| CVE-2008-6171 | High | 2009-02-19 | Not applicable | No public exploit | includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header. |
| CVE-2008-6170 | Low | 2009-02-19 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title. |
| CVE-2008-4793 | High | 2008-10-29 | Not applicable | No public exploit | The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules. |
| CVE-2008-4792 | Medium | 2008-10-29 | Not applicable | No public exploit | The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values. |
| CVE-2008-4791 | Medium | 2008-10-29 | Not applicable | No public exploit | The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vectors. |
| CVE-2008-4790 | Medium | 2008-10-29 | Not applicable | No public exploit | The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors. |
| CVE-2008-4789 | Medium | 2008-10-29 | Not applicable | No public exploit | The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error." |
| CVE-2008-3661 | Medium | 2008-09-23 | Not applicable | No public exploit | Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. |
| CVE-2008-3745 | Medium | 2008-08-27 | Not applicable | No public exploit | The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors. |
| CVE-2008-3744 | Medium | 2008-08-27 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules. |
| CVE-2008-3743 | Medium | 2008-08-27 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements. |
| CVE-2008-3742 | Medium | 2008-08-27 | Not applicable | No public exploit | Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated. |
| CVE-2008-3741 | Low | 2008-08-27 | Not applicable | No public exploit | The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML. |
| CVE-2008-3740 | Medium | 2008-08-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2008-3223 | High | 2008-07-18 | Not applicable | No public exploit | SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields." |
| CVE-2008-3222 | Medium | 2008-07-18 | Not applicable | No public exploit | Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors. |
| CVE-2008-3221 | Medium | 2008-07-18 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities. |
| CVE-2008-3220 | Medium | 2008-07-18 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of "translated strings." |
| CVE-2008-3219 | Medium | 2008-07-18 | Not applicable | No public exploit | The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism. |
| CVE-2008-3218 | Medium | 2008-07-18 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values. |
| CVE-2008-2999 | High | 2008-07-03 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2008-2771 | Medium | 2008-06-18 | Not applicable | No public exploit | The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors. |
| CVE-2008-1729 | Medium | 2008-04-11 | Not applicable | No public exploit | The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types. |
| CVE-2008-1133 | Medium | 2008-03-04 | Not applicable | No public exploit | The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS) attacks. |
| CVE-2008-1131 | Low | 2008-03-04 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal 6.0 allows remote authenticated users to inject arbitrary web script or HTML via titles in content edit forms. |
| CVE-2008-0462 | Medium | 2008-01-25 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Archive 5.x before 5.x-1.8 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2008-0276 | Medium | 2008-01-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via a site variable, related to lack of escaping of the variable table. |
| CVE-2008-0274 | Low | 2008-01-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files. |
| CVE-2008-0273 | Medium | 2008-01-15 | Not applicable | No public exploit | Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism. |
| CVE-2008-0272 | Medium | 2008-01-15 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users. |
| CVE-2007-6299 | High | 2007-12-10 | Not applicable | No public exploit | Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass input to the taxonomy_select_nodes function, as demonstrated by the (1) taxonomy_menu, (2) ajaxLoader, and (3) ubrowser contributed modules. |
| CVE-2007-5621 | Low | 2007-10-22 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames. |
| CVE-2007-5597 | Medium | 2007-10-19 | Not applicable | No public exploit | The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished comments from some modules, as demonstrated by (1) Organic groups and (2) Subscriptions. |
| CVE-2007-5596 | Medium | 2007-10-19 | Not applicable | No public exploit | The core Upload module in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 places the .html extension on a whitelist, which allows remote attackers to conduct cross-site scripting (XSS) attacks by uploading .html files. |
| CVE-2007-5595 | Medium | 2007-10-19 | Not applicable | No public exploit | CRLF injection vulnerability in the drupal_goto function in includes/common.inc Drupal 4.7.x before 4.7.8 and 5.x before 5.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. |
| CVE-2007-5594 | Medium | 2007-10-19 | Not applicable | No public exploit | Drupal 5.x before 5.3 does not apply its Drupal Forms API protection against the user deletion form, which allows remote attackers to delete users via a cross-site request forgery (CSRF) attack. |
| CVE-2007-5593 | Medium | 2007-10-19 | Not applicable | No public exploit | install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vectors that cause settings.php to be modified. |
| CVE-2007-5416 | Medium | 2007-10-12 | Not applicable | Working exploit published | Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be in PHP; if so, then this should not be treated as a vulnerability in Drupal. |
| CVE-2007-5270 | High | 2007-10-08 | Not applicable | No public exploit | Unspecified vulnerability in the Boost module before 4.7.x-1.0, and 5.x before 5.x-1.0, for Drupal allows remote attackers to create or overwrite arbitrary files, and conduct cross-site scripting attacks (XSS) via unspecified vectors. |
| CVE-2007-5228 | Low | 2007-10-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the subscription functionality in the Project issue tracking module before 4.7.x-1.5, 4.7.x-2.x before 4.7.x-2.5, and 5.x-1.x before 5.x-1.1 for Drupal allows remote authenticated users with project create or edit permissions to inject arbitrary web script or HTML via unspecified vectors involving a (1) individual or (2) overview form. |
| CVE-2007-4064 | Medium | 2007-07-30 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names. |
| CVE-2007-4063 | Medium | 2007-07-30 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API. |
| CVE-2007-1368 | Low | 2007-03-09 | Not applicable | No public exploit | The Project issue tracking module before 4.7.x-1.3, 4.7.x-2.* before 4.7.x-2.3, and 5 before 5.x-0.2-beta for Drupal allows remote authenticated users, with "access project issues" permission, to read the contents of a private node via a URL with a modified node identifier. |
| CVE-2007-0841 | High | 2007-02-08 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in vbDrupal before 4.7.6.0 have unknown impact and remote attack vectors. NOTE: the vector related to Drupal is covered by CVE-2007-0626. These vulnerabilities might be associated with other CVE identifiers. |
| CVE-2007-0658 | Medium | 2007-02-01 | Not applicable | No public exploit | The (1) Textimage 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal and the (2) Captcha 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal allow remote attackers to bypass the CAPTCHA test via an empty captcha element in $_SESSION. |
| CVE-2007-0626 | Medium | 2007-01-31 | Not applicable | No public exploit | The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines." |
| CVE-2007-0136 | Medium | 2007-01-09 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules. NOTE: some of these details are obtained from third party information. |
| CVE-2007-0124 | Low | 2007-01-09 | Not applicable | No public exploit | Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a denial of service by poisoning the page cache via unspecified vectors, which triggers erroneous 404 HTTP errors for pages that exist. |
| CVE-2006-6647 | Medium | 2006-12-20 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the MySite 4.7.x before 4.7.x-3.3 and 5.x before 5.x-1.3 module for Drupal allows remote attackers to inject arbitrary web script or HTML via the Title field when editing a page. NOTE: some details were obtained from third party information. |
| CVE-2006-6646 | Medium | 2006-12-20 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the check_plain function. |
| CVE-2006-5477 | Low | 2006-10-24 | Not applicable | No public exploit | Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows form submissions to be redirected, which allows remote attackers to obtain arbitrary form information via a crafted URL. |
| CVE-2006-5476 | High | 2006-10-24 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors. |
| CVE-2006-5475 | Medium | 2006-10-24 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed. |
| CVE-2006-4821 | Medium | 2006-09-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Userreview module before 1.19 2006/09/12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2006-4717 | High | 2006-09-12 | Not applicable | No public exploit | The login redirection mechanism in the Drupal 4.7 Pubcookie module before 1.2.2.4 2006/09/06 and the Drupal 4.6 Pubcookie module before 1.6.2.1 2006/09/07 allows remote attackers to bypass authentication requirements and spoof identities of arbitrary users via unspecified vectors. |
| CVE-2006-4646 | Medium | 2006-09-08 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Drupal 4.7 Pathauto module before pathauto_node.inc 1.17.2.1 and the Drupal 4.6 Pathauto module before pathauto_node.inc 1.14.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2006-4360 | Low | 2006-08-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in E-commerce 4.7 for Drupal before file.module 1.37.2.4 (20060812) allows remote authenticated users with the "create products" permission to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2006-4356 | High | 2006-08-27 | Not applicable | No public exploit | SQL injection vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2006-4355 | Low | 2006-08-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2006-4120 | Medium | 2006-08-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Recipe module (recipe.module) before 1.54 for Drupal 4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2006-4002 | Medium | 2006-08-07 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in user.module in Drupal 4.6 before 4.6.9, and 4.7 before 4.7.3, allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: portions of these details are obtained from third party information. |
| CVE-2006-3570 | Medium | 2006-07-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the webform module in Drupal 4.6 before July 8, 2006 and 4.7 before July 8, 2006 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2006-2833 | Low | 2006-06-06 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable. |
| CVE-2006-2832 | Low | 2006-06-06 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the upload module (upload.module) in Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via the uploaded filename. |
| CVE-2006-2831 | High | 2006-06-06 | Not applicable | No public exploit | Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743. |
| CVE-2006-2743 | Medium | 2006-06-01 | Not applicable | Working exploit published | Drupal 4.6.x before 4.6.7 and 4.7.0, when running on Apache with mod_mime, does not properly handle files with multiple extensions, which allows remote attackers to upload, modify, or execute arbitrary files in the files directory. |
| CVE-2006-2742 | High | 2006-06-01 | Not applicable | No public exploit | SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc. |
| CVE-2006-2260 | Medium | 2006-05-09 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. |
| CVE-2006-1228 | Medium | 2006-03-14 | Not applicable | No public exploit | Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier. |
| CVE-2006-1227 | Medium | 2006-03-14 | Not applicable | No public exploit | Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.module is used to create a menu item, does not implement access control for the page that is referenced, which might allow remote attackers to access administrator pages. |
| CVE-2006-1226 | Medium | 2006-03-14 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. |
| CVE-2006-1225 | Medium | 2006-03-14 | Not applicable | No public exploit | CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy. |
| CVE-2006-0070 | Medium | 2006-01-04 | Not applicable | No public exploit | Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function. NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE |
| CVE-2005-3975 | Medium | 2005-12-03 | Not applicable | No public exploit | Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Drupal. |
| CVE-2005-3974 | Medium | 2005-12-03 | Not applicable | No public exploit | Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission. |