CVSS: 7.5EPSS: 97%CPEs: 2EXPL: 17CVE-2014-3704 – Drupal 7.0 < 7.31 - 'Drupalgeddon' SQL Injection (Add Admin User)
https://notcve.org/view.php?id=CVE-2014-3704
The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys. La función expandArguments en la API de la base de datos de abstracción para Drupal core 7.x anterior a 7.32 no construye correctamente las declaraciones, lo que permite a atacantes remotos inducir a ataques de inyección SQL a través de un array que contiene claves manipuladas. Drupal versions 7.0 through 7.31 suffer from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/34992 https://www.exploit-db.com/exploits/34993 https://www.exploit-db.com/exploits/44355 https://www.exploit-db.com/exploits/35150 https://www.exploit-db.com/exploits/34984 https://github.com/happynote3966/CVE-2014-3704 http://osvdb.org/show/osvdb/113371 http://packetstormsecurity.com/files/128720/Drupal-7.X-SQL-Injection.html http://packetstormsecurity.com/files/128721/Drupal-7.31-SQL-Injection.html http://packetstormsecurity.com/files/128 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 88EXPL: 0CVE-2014-5267
https://notcve.org/view.php?id=CVE-2014-5267
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document. modules/openid/xrds.inc en Drupal 6.x anterior a 6.33 y 7.x anterior a 7.31 permite a atacantes remotos tener un impacto no especificado a través de una declaración DOCTYPE manipulada en un documento XRDS. • http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830 http://openwall.com/lists/oss-security/2014/08/16/4 http://www.debian.org/security/2014/dsa-2999 https://www.drupal.org/SA-CORE-2014-004 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 92%CPEs: 122EXPL: 0CVE-2014-5266 – WordPress Core < 3.9.2 - Denial of Service via XML #2
https://notcve.org/view.php?id=CVE-2014-5266
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265. La libraría Incutio XML-RPC (IXR) , utilizado en WordPress anterior a 3.9.2 y Drupal 6.x anterior a 6.33 y 7.x anterior a 7.31, no limita el número de elementos en un documento XML, lo que permite a atacantes remotos causar una denegación de servicio (consumo de CPU) a través de un documento grande, una vulnerabilidad diferente a CVE-2014-5265. Wordpress XMLRPC parsing is vulnerable to a XML based denial of service. This vulnerability affects Wordpress 3.5 - 3.9.2 (3.8.4 and 3.7.4 are also patched). • http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830 http://www.debian.org/security/2014/dsa-2999 http://www.debian.org/security/2014/dsa-3001 https://core.trac.wordpress.org/changeset/29404 https://wordpress.org/news/2014/08/wordpress-3-9-2 https://www.drupal.org/SA-CORE-2014-004 http://www.breaksec.com/?p=6362 https://mashable.com/archive/wordpress-xml-blowup-dos • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 43%CPEs: 122EXPL: 0CVE-2014-5265 – WordPress Core < 3.9.2 - Denial of Service via XML
https://notcve.org/view.php?id=CVE-2014-5265
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. La librería Incutio XML-RPC (IXR), utilizada en WordPress anterior a 3.9.2 y Drupal 6.x anterior a 6.33 y 7.x anterior a 7.31, permite declaraciones de entidad sin considerar la recursión durante la expansión de la entidad, lo que permite a atacantes remotos causar una denegación de servicios (consumo de memoria y CPU) a través de un documento XML manipulado que contiene un número grande de referencias de entidad anidadas, un problema similar al CVE-2003-1564. • http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830 http://www.debian.org/security/2014/dsa-2999 http://www.debian.org/security/2014/dsa-3001 https://core.trac.wordpress.org/changeset/29404 https://wordpress.org/news/2014/08/wordpress-3-9-2 https://www.drupal.org/SA-CORE-2014-004 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 86EXPL: 0CVE-2014-5019
https://notcve.org/view.php?id=CVE-2014-5019
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use. La funcionalidad múltisitios en Drupal 6.x anterior a 6.32 y 7.x anterior a 7.29 permite a atacantes remotos causar una denegación de servicio a través de una cabecera HTTP Host manipulada, relacionado con determinar qué fichero de configuración utilizar. • http://www.debian.org/security/2014/dsa-2983 https://www.drupal.org/SA-CORE-2014-003 • CWE-20: Improper Input Validation •