CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register   Reset Password   Activate Account
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Drupal : Security Vulnerabilities (CVSS score between 7 and 7.99)

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Copy Results Download Results Select Table
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2012-2306 89 Exec Code Sql 2012-07-25 2012-09-11
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Addressbook module for Drupal 6.x-4.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
2 CVE-2011-2687 264 Bypass 2011-07-26 2011-07-28
7.5
 None Remote Low Not required Partial Partial Partial
Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.
3 CVE-2009-1507 264 Bypass 2009-05-01 2009-05-13
7.5
 None Remote Low Not required Partial Partial Partial
The Node Access User Reference module 5.x before 5.x-2.0-beta4 and 6.x before 6.x-2.0-beta6, a module for Drupal, interprets an empty CCK user reference as a reference to the anonymous user, which might allow remote attackers to bypass intended access restrictions to read or modify a node.
4 CVE-2009-1505 89 Exec Code Sql 2009-05-01 2010-03-31
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the News Page module 5.x before 5.x-1.2 for Drupal allows remote authenticated users, with News Page nodes create and edit privileges, to execute arbitrary SQL commands via the Include Words (aka keywords) field.
5 CVE-2008-6137 264 Bypass 2009-02-13 2009-08-19
7.5
 User Remote Low Not required Partial Partial Partial
EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to bypass access restrictions via unknown vectors.
6 CVE-2008-6136 264 +Priv 2009-02-13 2009-08-19
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to gain privileges as another user or an administrator via unknown attack vectors.
7 CVE-2008-6134 89 Exec Code Sql 2009-02-13 2009-08-19
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
8 CVE-2008-6020 89 Exec Code Sql 2009-02-02 2009-07-10
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an exposed filter on CCK text fields."
9 CVE-2008-4793 264 Bypass 2008-10-29 2009-08-19
7.5
 User Remote Low Not required Partial Partial Partial
The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules.
10 CVE-2008-4598 XSS 2008-10-17 2009-07-22
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in Shindig-Integrator 5.x, a module for Drupal, has unspecified impact and remote attack vectors related to "numerous flaws" that are not related to XSS or access control, a different vulnerability than CVE-2008-4596 and CVE-2008-4597.
11 CVE-2008-4597 264 +Priv 2008-10-17 2009-07-22
7.5
 User Remote Low Not required Partial Partial Partial
Shindig-Integrator 5.x, a module for Drupal, does not properly restrict generated page access, which allows remote attackers to gain privileges via unspecified vectors.
12 CVE-2008-4531 89 Exec Code Sql 2008-10-09 2008-10-10
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Brilliant Gallery 5.x before 5.x-4.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to queries. NOTE: this might be the same issue as CVE-2008-4338.
13 CVE-2008-4148 89 Exec Code Sql 2008-09-24 2009-08-19
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to composing queries without using the Drupal database API.
14 CVE-2008-3223 89 Exec Code Sql 2008-07-18 2009-08-19
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."
15 CVE-2008-2999 89 Exec Code Sql 2008-07-03 2009-09-09
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
16 CVE-2008-2850 89 Exec Code Sql 2008-06-25 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified cookies, related to improper use of the Drupal database API.
17 CVE-2008-2772 94 Exec Code 2008-06-18 2009-04-08
7.5
 User Remote Low Not required Partial Partial Partial
The Magic Tabs module 5.x before 5.x-1.1 for Drupal allows remote attackers to execute arbitrary PHP code via unspecified URL arguments, possibly related to a missing "whitelist of callbacks."
18 CVE-2008-2271 264 +Priv 2008-05-16 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The Site Documentation Drupal module 5.x before 5.x-1.8 and 6.x before 6.x-1.1 allows remote authenticated users to gain privileges of other users by leveraging the "access content" permission to list tables and obtain session IDs from the database.
19 CVE-2007-6299 20 Exec Code Sql 2007-12-10 2008-09-05
7.5
 None Remote Low Not required Partial Partial Partial
Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL commands via modules that pass input to the taxonomy_select_nodes function, as demonstrated by the (1) taxonomy_menu, (2) ajaxLoader, and (3) ubrowser contributed modules.
20 CVE-2007-3690 2007-07-11 2008-11-15
7.8
 None Remote Low Not required Complete None None
The Forward module before 4.7-1.1 and 5.x before 5.x-1.0 for Drupal allows remote attackers to read restricted posts in (1) Organic Groups, (2) Taxonomy Access Control, (3) Taxonomy Access Lite, and other unspecified node access modules, via modified URL arguments.
21 CVE-2007-3689 2007-07-11 2008-11-15
7.8
 None Remote Low Not required Complete None None
The Print module before 4.7-1.0 and 5.x before 5.x-1.2 for Drupal allows remote attackers to read restricted posts in (1) Organic Groups, (2) Taxonomy Access Control, (3) Taxonomy Access Lite, and other unspecified node access modules, via modified URL arguments.
22 CVE-2007-2160 CSRF 2007-04-22 2008-11-13
7.5
 User Remote Low Not required Partial Partial Partial
Multiple cross-site request forgery (CSRF) vulnerabilities in the Database Administration (dba) module 4.6.x-*, and before 4.7.x-1.2 in the 4.7.x-1.* series, for Drupal allow remote attackers to perform unauthorized actions as an arbitrary user, a related issue to CVE-2006-5476.
23 CVE-2007-1035 2007-02-21 2008-11-15
7.5
 User Remote Low Not required Partial Partial Partial
Unspecified vulnerability in certain demonstration scripts in getID3 1.7.1, as used in the Mediafield and Audio modules for Drupal, allows remote attackers to read and delete arbitrary files, list arbitrary directories, and write to empty files or .mp3 files via unknown vectors.
24 CVE-2007-1033 Bypass 2007-02-21 2009-03-16
7.5
 None Remote Low Not required Partial Partial Partial
Unspecified vulnerability in the Secure site 4.7.x-1.x-dev and 5.x-1.x-dev module for Drupal allows remote attackers to bypass access restrictions via a crafted URL.
25 CVE-2007-0626 20 Exec Code 2007-01-31 2011-07-13
7.6
 Admin Remote High Not required Complete Complete Complete
The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines."
26 CVE-2006-6530 Exec Code Sql 2006-12-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Help Tip module before 4.7.x-1.0 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
27 CVE-2006-6529 +Info 2006-12-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The Chatroom Module before 4.7.x.-1.0 for Drupal displays private messages in a chatroom's last messages overview, which allows remote attackers to obtain sensitive information by reading the overview.
28 CVE-2006-6528 +Priv 2006-12-13 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges.
29 CVE-2006-5608 Exec Code Sql 2006-10-30 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Extended Tracker (xtracker) 4.7 before 1.5.2.1 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "parameters from URLs."
30 CVE-2006-5476 CSRF 2006-10-24 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Cross-site request forgery (CSRF) vulnerability in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows remote attackers to perform unauthorized actions as an arbitrary user via unspecified vectors.
31 CVE-2006-4717 Bypass 2006-09-12 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
The login redirection mechanism in the Drupal 4.7 Pubcookie module before 1.2.2.4 2006/09/06 and the Drupal 4.6 Pubcookie module before 1.6.2.1 2006/09/07 allows remote attackers to bypass authentication requirements and spoof identities of arbitrary users via unspecified vectors.
32 CVE-2006-4356 Exec Code Sql 2006-08-26 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Drupal Easylinks Module (easylinks.module) 4.7 before 1.5.2.1 2006/08/19 12:02:27 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
33 CVE-2006-4108 Exec Code Sql 2006-08-14 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Bibliography (biblio.module) 4.6 before revision 1.1.1.1.4.11 and 4.7 before revision 1.13.2.5 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
34 CVE-2006-4107 Exec Code Sql 2006-08-14 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in the Job Search module (job.module) 4.6 before revision 1.3.2.1 in Drupal allows remote attackers to execute arbitrary SQL commands via a job or resume search.
35 CVE-2006-3473 2006-07-10 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
CRLF injection vulnerability in form_mail Drupal Module before 1.8.2.2 allows remote attackers to inject e-mail headers, which facilitates sending spam messages, a different issue than CVE-2006-1225.
36 CVE-2006-2831 Exec Code 2006-06-05 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Drupal 4.6.x before 4.6.8 and 4.7.x before 4.7.2, when running under certain Apache configurations such as when FileInfo overrides are disabled within .htaccess, allows remote attackers to execute arbitrary code by uploading a file with multiple extensions, a variant of CVE-2006-2743.
37 CVE-2006-2742 Exec Code Sql 2006-06-01 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
SQL injection vulnerability in Drupal 4.6.x before 4.6.7 and 4.7.0 allows remote attackers to execute arbitrary SQL commands via the (1) count and (2) from variables to (a) database.mysql.inc, (b) database.pgsql.inc, and (c) database.mysqli.inc.
38 CVE-2005-1871 +Priv 2005-06-09 2008-09-05
7.5
 User Remote Low Not required Partial Partial Partial
Unknown vulnerability in the privilege system in Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges, due to an "input check" that "is not implemented properly."
Total number of vulnerabilities : 38   Page : 1 (This Page)
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.