The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules.
Max CVSS
7.5
EPSS Score
0.54%
Published
2008-10-29
Updated
2017-08-08
The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values.
Max CVSS
6.0
EPSS Score
0.22%
Published
2008-10-29
Updated
2018-11-02
The user module in Drupal 5.x before 5.11 and 6.x before 6.5 might allow remote authenticated users to bypass intended login access rules and successfully login via unknown vectors.
Max CVSS
6.0
EPSS Score
0.22%
Published
2008-10-29
Updated
2018-11-02
The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors.
Max CVSS
6.0
EPSS Score
0.28%
Published
2008-10-29
Updated
2017-08-08
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error."
Max CVSS
6.0
EPSS Score
0.17%
Published
2008-10-29
Updated
2017-08-08
SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again" is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to a "previously cast vote."
Max CVSS
6.0
EPSS Score
0.10%
Published
2008-10-21
Updated
2017-08-08
Unspecified vulnerability in Shindig-Integrator 5.x, a module for Drupal, has unspecified impact and remote attack vectors related to "numerous flaws" that are not related to XSS or access control, a different vulnerability than CVE-2008-4596 and CVE-2008-4597.
Max CVSS
7.5
EPSS Score
0.31%
Published
2008-10-17
Updated
2017-08-08
Shindig-Integrator 5.x, a module for Drupal, does not properly restrict generated page access, which allows remote attackers to gain privileges via unspecified vectors.
Max CVSS
7.5
EPSS Score
0.52%
Published
2008-10-17
Updated
2017-08-08
SQL injection vulnerability in Brilliant Gallery 5.x before 5.x-4.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to queries. NOTE: this might be the same issue as CVE-2008-4338.
Max CVSS
7.5
EPSS Score
0.15%
Published
2008-10-09
Updated
2017-08-08
The Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, does not perform access checks for a node before displaying comments, which allows remote attackers to obtain sensitive information.
Max CVSS
5.0
EPSS Score
0.43%
Published
2008-09-24
Updated
2017-08-08
SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to composing queries without using the Drupal database API.
Max CVSS
7.5
EPSS Score
0.25%
Published
2008-09-24
Updated
2017-08-08
The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors.
Max CVSS
5.5
EPSS Score
0.22%
Published
2008-08-27
Updated
2017-08-08
Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules.
Max CVSS
5.8
EPSS Score
0.35%
Published
2008-08-27
Updated
2017-08-08
Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements.
Max CVSS
5.8
EPSS Score
0.28%
Published
2008-08-27
Updated
2017-08-08
Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated.
Max CVSS
6.5
EPSS Score
1.44%
Published
2008-08-27
Updated
2017-08-08
Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
Max CVSS
5.0
EPSS Score
0.22%
Published
2008-09-23
Updated
2021-04-21
SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."
Max CVSS
7.5
EPSS Score
0.44%
Published
2008-07-18
Updated
2021-04-15
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.
Max CVSS
5.8
EPSS Score
0.45%
Published
2008-07-18
Updated
2021-04-15
The Outline Designer module 5.x before 5.x-1.4 for Drupal changes each content reader's authentication level to match that of the content author, which might allow remote attackers to gain privileges.
Max CVSS
6.5
EPSS Score
0.23%
Published
2008-07-09
Updated
2017-08-08
SQL injection vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit post permissions, to execute arbitrary SQL commands via unspecified vectors.
Max CVSS
6.5
EPSS Score
0.10%
Published
2008-07-09
Updated
2017-08-08
The Aggregation module 5.x before 5.x-4.4 for Drupal allows remote attackers to upload files with arbitrary extensions, and possibly execute arbitrary code, via a crafted feed that allows upload of files with arbitrary extensions.
Max CVSS
9.3
EPSS Score
3.73%
Published
2008-07-03
Updated
2017-08-08
The Aggregation module 5.x before 5.x-4.4 for Drupal, when node access modules are used, does not properly implement access control, which allows remote attackers to bypass intended restrictions.
Max CVSS
6.8
EPSS Score
0.62%
Published
2008-07-03
Updated
2017-08-08
Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
Max CVSS
7.5
EPSS Score
0.14%
Published
2008-07-03
Updated
2017-08-08
SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified cookies, related to improper use of the Drupal database API.
Max CVSS
7.5
EPSS Score
0.15%
Published
2008-06-25
Updated
2017-08-08
The Magic Tabs module 5.x before 5.x-1.1 for Drupal allows remote attackers to execute arbitrary PHP code via unspecified URL arguments, possibly related to a missing "whitelist of callbacks."
Max CVSS
7.5
EPSS Score
0.79%
Published
2008-06-18
Updated
2017-08-08
35 vulnerabilities found
1 2
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!