CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2008-3743
https://notcve.org/view.php?id=CVE-2008-3743
Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en forms de Drupal 6.x antes de 6.4 permiten a atacantes remotos realizar acciones no especificadas mediante vectores desconocidos, relacionados a validaciones de testigo (token) incorrectas para (1) cached forms y (2) forms con elementos AHAH. • http://drupal.org/node/295053 http://secunia.com/advisories/31462 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44453 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2008-3740
https://notcve.org/view.php?id=CVE-2008-3740
Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el filtro de salida de Drupal 5.x anterior a 5.10 y 6.x anterior a 6.4, permite a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección a través de vectores no especificados. • http://drupal.org/node/295053 http://secunia.com/advisories/31462 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44445 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2008-3500
https://notcve.org/view.php?id=CVE-2008-3500
Cross-site scripting (XSS) vulnerability in the Suggested Terms module 5.x before 5.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via crafted Taxonomy terms. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo Suggested Terms 5.x versiones anteriores a 5.x-1.2 para Drupal permite a usuarios remotos autenticados inyectar web script o HTML a través de términos Taxonomy manipulados. • http://drupal.org/node/274919 http://secunia.com/advisories/30846 http://www.securityfocus.com/bid/29953 http://www.vupen.com/english/advisories/2008/1931/references https://exchange.xforce.ibmcloud.com/vulnerabilities/43363 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2008-3223
https://notcve.org/view.php?id=CVE-2008-3223
SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields." Vulnerabilidad de inyección SQL en el Schema API de versiones de Drupal 6.x anteriores a 6.3 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores relacionados con un "inadeacuado marcador de posición para campos 'numéricos'" • http://drupal.org/node/280571 http://secunia.com/advisories/31079 http://www.openwall.com/lists/oss-security/2008/07/10/3 http://www.securityfocus.com/bid/30168 https://bugzilla.redhat.com/show_bug.cgi?id=454849 https://exchange.xforce.ibmcloud.com/vulnerabilities/43705 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html https://www.redhat.com/archives/fedora-package-announce& • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-3218
https://notcve.org/view.php?id=CVE-2008-3218
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values. Múltiples vulnerabilidades de cross-site scripting (XSS) en versiones de Drupal 6.x anteriores a 6.3 permiten a atacantes remotos inyectar scripts web o HTML arbitrario a través de vectores relacionados con (1) un etiquetado libre de términos de taxonomía, que no son manejados correctamente en el módulo de vista previa, y con (2) valores OpenID sin especificar. • http://drupal.org/node/280571 http://secunia.com/advisories/31079 http://www.openwall.com/lists/oss-security/2008/07/10/3 http://www.securityfocus.com/bid/30168 https://bugzilla.redhat.com/show_bug.cgi?id=454849 https://exchange.xforce.ibmcloud.com/vulnerabilities/43704 https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html https://www.redhat.com/archives/fedora-package-announce& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •