CVSS: 4.3EPSS: 0%CPEs: 20EXPL: 0CVE-2008-6533
https://notcve.org/view.php?id=CVE-2008-6533
Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. Drupal v5.x anterior a v5.13 y v6.x anterior a v6.7 no borra el contenido relacionado cuando un formato de entrada es eliminado, lo que evita que se filtre adecuadamente y permita a atacantes remotos llevar a cabo ataques de ejecución de secuencias de comandos en sitios cruzados (XSS) a través de vectores no especificados. • http://drupal.org/node/345441 http://secunia.com/advisories/33112 http://secunia.com/advisories/33147 http://www.osvdb.org/50662 http://www.vupen.com/english/advisories/2008/3414 https://exchange.xforce.ibmcloud.com/vulnerabilities/47259 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 20EXPL: 0CVE-2008-6532
https://notcve.org/view.php?id=CVE-2008-6532
Multiple cross-site request forgery (CSRF) vulnerabilities in the update feature in Drupal 5.x before 5.13 and 6.x before 6.7 allow remote attackers to perform unauthorized actions as the superuser via unspecified vectors, as demonstrated by causing the superuser to "execute old updates" that modify the database. Vulnerabilidad múltiple de falsificación de petición en sitios cruzados - CSRF - en la característica de actualización en Drupal v5.x anteriores a v5.13 y v6.x anteriores a v6.7, permiten a los atacantes remotos desarrollar acciones no autorizadas como el superusuarío a través de vectores no especificados, como se ha demostrado por provocación del superusuario la "ejecución de antiguas actualizaciones" que modifican la base de datos. • http://drupal.org/node/345441 http://secunia.com/advisories/33112 http://secunia.com/advisories/33147 http://www.osvdb.org/50661 http://www.vupen.com/english/advisories/2008/3414 https://exchange.xforce.ibmcloud.com/vulnerabilities/47260 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html • CWE-352: Cross-Site Request Forgery (CSRF) •