Drupal : Security Vulnerabilities Published In 2014
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
| Max Base Score | 5.0 |
| Published | 2014-11-24 |
| Updated | 2021-04-20 |
| EPSS | 3.96% |
Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.
| Max Base Score | 6.8 |
| Published | 2014-11-24 |
| Updated | 2018-12-20 |
| EPSS | 0.69% |
Multiple cross-site scripting (XSS) vulnerabilities in the Project Issue File Review module (PIFR) module 6.x-2.x before 6.x-2.17 for Drupal allow (1) remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to the PIFR_Server test results page or (2) remote authenticated users with the "manage PIFR environments" permission to inject arbitrary web script or HTML via vectors involving a PIFR_Server administrative page.
| Max Base Score | 4.3 |
| Published | 2014-10-14 |
| Updated | 2014-10-22 |
| EPSS | 0.22% |
Cross-site scripting (XSS) vulnerability in the Google Doubleclick for Publishers (DFP) module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name.
| Max Base Score | 3.5 |
| Published | 2014-10-13 |
| Updated | 2014-10-16 |
| EPSS | 0.10% |
Cross-site scripting (XSS) vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages.
| Max Base Score | 4.3 |
| Published | 2014-10-13 |
| Updated | 2017-09-08 |
| EPSS | 0.27% |
Cross-site scripting (XSS) vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
| Max Base Score | 3.5 |
| Published | 2014-10-13 |
| Updated | 2017-09-08 |
| EPSS | 0.10% |
Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label.
| Max Base Score | 3.5 |
| Published | 2014-10-13 |
| Updated | 2017-09-08 |
| EPSS | 0.11% |
Cross-site scripting (XSS) vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer nivo slider" permission to inject arbitrary web script or HTML via an image title.
| Max Base Score | 3.5 |
| Published | 2014-10-13 |
| Updated | 2017-09-08 |
| EPSS | 0.11% |
Multiple cross-site scripting (XSS) vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a (1) Role or (2) Organic Group name.
| Max Base Score | 3.5 |
| Published | 2014-10-13 |
| Updated | 2017-09-08 |
| EPSS | 0.11% |
The Organic Groups Menu (aka OG Menu) module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to change module settings via unspecified vectors.
| Max Base Score | 3.5 |
| Published | 2014-11-12 |
| Updated | 2017-09-08 |
| EPSS | 0.12% |
Cross-site scripting (XSS) vulnerability in the Modal Frame API module 6.x-1.x before 6.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
| Max Base Score | 4.3 |
| Published | 2014-10-16 |
| Updated | 2017-09-08 |
| EPSS | 0.22% |
Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to header background setting.
| Max Base Score | 4.0 |
| Published | 2014-10-09 |
| Updated | 2017-09-08 |
| EPSS | 0.12% |
Cross-site scripting (XSS) vulnerability in the Print (aka Printer, e-mail and PDF versions) module 6.x-1.x before 6.x-1.19, 7.x-1.x before 7.x-1.3, and 7.x-2.x before 7.x-2.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to nodes.
| Max Base Score | 3.5 |
| Published | 2014-10-09 |
| Updated | 2017-09-08 |
| EPSS | 0.12% |
Cross-site scripting (XSS) vulnerability in the NewsFlash theme 6.x-1.x before 6.x-1.7 and 7.x-1.x before 7.x-2.5 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to font family CSS property.
| Max Base Score | 3.5 |
| Published | 2014-10-09 |
| Updated | 2017-09-08 |
| EPSS | 0.12% |
Cross-site scripting (XSS) vulnerability in the Professional theme 7.x before 7.x-2.04 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to custom copyright information.
| Max Base Score | 3.5 |
| Published | 2014-10-09 |
| Updated | 2017-09-08 |
| EPSS | 0.10% |
Cross-site scripting (XSS) vulnerability in the Tribune module 6.x-1.x and 7.x-3.x for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title.
| Max Base Score | 3.5 |
| Published | 2014-10-09 |
| Updated | 2017-09-08 |
| EPSS | 0.12% |
Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.
| Max Base Score | 3.5 |
| Published | 2014-10-08 |
| Updated | 2014-10-09 |
| EPSS | 0.11% |
Cross-site scripting (XSS) vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
| Max Base Score | 3.5 |
| Published | 2014-10-08 |
| Updated | 2017-09-08 |
| EPSS | 0.11% |
Cross-site scripting (XSS) vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings.
| Max Base Score | 3.5 |
| Published | 2014-10-08 |
| Updated | 2017-09-08 |
| EPSS | 0.11% |
Cross-site scripting (XSS) vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to admin/config/search/custom_search/results.
| Max Base Score | 3.5 |
| Published | 2014-10-06 |
| Updated | 2014-10-07 |
| EPSS | 0.10% |
Cross-site scripting (XSS) vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer contexts" permission to inject arbitrary web script or HTML via unspecified vectors.
| Max Base Score | 3.5 |
| Published | 2014-10-06 |
| Updated | 2014-10-07 |
| EPSS | 0.10% |
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
| Max Base Score | 6.8 |
| Published | 2014-09-30 |
| Updated | 2014-10-10 |
| EPSS | 0.54% |
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
| Max Base Score | 5.0 |
| Published | 2014-08-18 |
| Updated | 2015-11-25 |
| EPSS | 94.72% |
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
| Max Base Score | 5.0 |
| Published | 2014-08-18 |
| Updated | 2015-11-25 |
| EPSS | 50.32% |
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.
| Max Base Score | 4.3 |
| Published | 2014-07-22 |
| Updated | 2014-07-22 |
| EPSS | 0.14% |