CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2008-7150
https://notcve.org/view.php?id=CVE-2008-7150
Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refine_by_taxo when displaying tags. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Taxonomy v5.x anterior v.5.x-0.1, un módulo para Drupal, permite a atacantes remotos inyectar script web o HTML a su elección a través de un término taxonomy, que no es gestionado apropiadamente por refine_by_taxo cuando muestra etiquetas. • http://drupal.org/node/230460 http://drupal.org/node/230470 https://exchange.xforce.ibmcloud.com/vulnerabilities/41035 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 12EXPL: 0CVE-2008-6972
https://notcve.org/view.php?id=CVE-2008-6972
Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings. Vulnerabilidad múltiple de ejecución de secuencias de comandos en sitios cruzados - XSS - en Drupal Content Construction Kit (CCK) v5.x hasta v5.x-1.8 permite a los usuarios remotos autenticados con permisos "administrar contenido" inyectar arbitrariamente una secuencia de comandos web o HTML a través de los parámetros (1) "field label," (2) "help text," o (3) "allowed values". • http://drupal.org/node/304093 http://osvdb.org/47929 http://secunia.com/advisories/31757 http://www.securityfocus.com/bid/31027 https://exchange.xforce.ibmcloud.com/vulnerabilities/44915 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-6909
https://notcve.org/view.php?id=CVE-2008-6909
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges. El Modulo Services v5.x anterior a v5.x-0.92 y v6.x anterior a v6.x-0.13 para Drupal, no firma todos los datos necesarios en las peticiones, cuyo impacto se desconoce, probablemente relacionado con ataques de hombre-en-el-medio (man-in-the-middle)que modifican datos críticos y permiten a atacantes remotos suplantar a otros usuarios y obtener privilegios. • http://drupal.org/node/348295 http://osvdb.org/50743 http://www.securityfocus.com/bid/32894 https://exchange.xforce.ibmcloud.com/vulnerabilities/47458 https://exchange.xforce.ibmcloud.com/vulnerabilities/52438 • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-6910
https://notcve.org/view.php?id=CVE-2008-6910
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request. El Modulo Services v5.x anterior a v5.x-0.92 y v6.x anterior a v6.x-0.13 para Drupal, no emplea tiempos de espera para las peticiones firmadas, lo que permite a atacantes remotos suplantar a otros usuarios y obtener privilegios a través de un ataque de reproducción que envía la misma petición. • http://drupal.org/node/348295 http://osvdb.org/50743 http://www.securityfocus.com/bid/32894 https://exchange.xforce.ibmcloud.com/vulnerabilities/52441 • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 0%CPEs: 8EXPL: 0CVE-2008-6908
https://notcve.org/view.php?id=CVE-2008-6908
Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges. Services v5.x anterior a v5.x-0.92 y v6.x anterior a v6.x-0.13, un módulo de Drupal, utiliza un hash inseguro al firmar las solicitudes, lo que permite a atacantes remotos suplantar a otros usuarios y obtener privilegios. • http://drupal.org/node/348295 http://osvdb.org/50743 http://www.securityfocus.com/bid/32894 https://exchange.xforce.ibmcloud.com/vulnerabilities/47458 • CWE-310: Cryptographic Issues •