Drupal : Security Vulnerabilities (Gain Privilege)

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2016-6211	264	+Priv	2016-09-09	2016-11-28	6.5	None	Remote	Low	???	Partial	Partial	Partial
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
2	CVE-2016-3169	264	+Priv	2016-04-12	2016-04-13	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
3	CVE-2008-6136	264	+Priv	2009-02-14	2017-08-17	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unspecified vulnerability in EveryBlog 5.x and 6.x, a module for Drupal, allows remote attackers to gain privileges as another user or an administrator via unknown attack vectors.
4	CVE-2008-4597	264	+Priv	2008-10-17	2017-08-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Shindig-Integrator 5.x, a module for Drupal, does not properly restrict generated page access, which allows remote attackers to gain privileges via unspecified vectors.
5	CVE-2008-3096	264	+Priv	2008-07-09	2017-08-08	6.5	None	Remote	Low	???	Partial	Partial	Partial
The Outline Designer module 5.x before 5.x-1.4 for Drupal changes each content reader's authentication level to match that of the content author, which might allow remote attackers to gain privileges.
6	CVE-2008-0568		+Priv	2008-02-05	2011-03-08	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
Unspecified vulnerability in the IP-authentication feature in the Secure Site 5.x-1.0 and 4.7.x-1.0 module for Drupal allows remote attackers to gain the privileges of a user who has authenticated from behind the same proxy server as the attacker.
7	CVE-2007-3818		+Priv XSS	2007-07-17	2012-10-31	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."
8	CVE-2006-6528		+Priv	2006-12-14	2011-03-08	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The Chatroom Module before 4.7.x.-1.0 for Drupal broadcasts Chatroom visitors' session IDs to all participants, which allows remote attackers to hijack sessions and gain privileges.
9	CVE-2006-1228	287	+Priv	2006-03-14	2018-10-18	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier.
10	CVE-2005-1871		+Priv	2005-06-09	2016-10-18	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Unknown vulnerability in the privilege system in Drupal 4.4.0 through 4.6.0, when public registration is enabled, allows remote attackers to gain privileges, due to an "input check" that "is not implemented properly."

Total number of vulnerabilities : 10 Page : 1 (This Page)