CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2013-5965
https://notcve.org/view.php?id=CVE-2013-5965
The Node View Permissions module 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the hook_query_alter function, which might allow remote attackers to obtain sensitive information by reading a node listing. El módulo Node View permissions 7.x-1-x (anteriores a 7.x-1.2) para Drupal no implementa apropiadamente la función hook_query_alter, lo que podría permitir a atacantes remotos obtener información sensible leyendo la lista de nodos. • http://archives.neohapsis.com/archives/bugtraq/2013-08/0184.html http://secunia.com/advisories/54550 http://www.openwall.com/lists/oss-security/2013/09/11/9 https://drupal.org/node/2031621 https://drupal.org/node/2076315 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 4EXPL: 0CVE-2013-5964
https://notcve.org/view.php?id=CVE-2013-5964
Cross-site scripting (XSS) vulnerability in the administration page in the Flag module 7.x-3.x before 7.x-3.1 for Drupal allows remote authenticated users with the "Administer flags" permission to inject arbitrary web script or HTML via the flag title. Vulnerabilidad cross-site scripting (XSS) en la página de administración del módulo Flag 7.x-3.x anteriores a 7.x-3.1 para Drupal permite a usuarios autenticados remotos con permisos "Administer flags" inyectar script web o HTML a través del título de flag. • http://archives.neohapsis.com/archives/bugtraq/2013-08/0184.html http://osvdb.org/96750 http://seclists.org/fulldisclosure/2013/Aug/287 https://drupal.org/node/2075287 https://drupal.org/node/2076221 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 27EXPL: 1CVE-2013-4274
https://notcve.org/view.php?id=CVE-2013-4274
Cross-site scripting (XSS) vulnerability in the password_policy_admin_view function in password_policy.admin.inc in the Password Policy module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer policies" permission to inject arbitrary web script or HTML via the "Password Expiration Warning" field to the admin/config/people/password_policy/add page. Vulnerabilidad Cross-site scripting (XSS) en la función password_policy_admin_view en password_policy.admin.inc en el módulo Password Policy v6.x-1.x anterior a v6.x-1.6 y v7.x-1.x anterior a v7.x-1.5 para Drupal, lo que permite a usuarios remotos autenticados con el permiso "Administer policies" inyectar secuencias de comandos web o HTML arbitrarias a través del campo "Password Expiration Warning" en la página admin/config/people/password_policy/add. • http://www.madirish.net/557 http://www.openwall.com/lists/oss-security/2013/08/22/2 http://www.securityfocus.com/bid/61780 https://drupal.org/node/2065241 https://drupal.org/node/2065387 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 12EXPL: 0CVE-2013-2197
https://notcve.org/view.php?id=CVE-2013-2197
The Login Security module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal, when using the login delay option, allows remote attackers to cause a denial of service (CPU consumption) via a large number of failed login attempts. El módulo Login Security v6.x-1.x anterior a v6.x-1.3 y v7.x-1.x anterior a v7.x-1.3 para Drupal, cuando se utiliza la opción de retraso de inicio de sesión, permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) a través de un gran número de intentos de conexión fallidos. • http://www.openwall.com/lists/oss-security/2013/06/20/3 https://drupal.org/node/2023503 https://drupal.org/node/2023507 https://drupal.org/node/2023585 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2013-4272
https://notcve.org/view.php?id=CVE-2013-4272
The BOTCHA Spam Prevention module 7.x-1.x before 7.x-1.6, 7.x-2.x before 7.x-2.1, and 7.x-3.x before 7.x-3.3 for Drupal, when the debugging level is set to 5 or 6, logs the content of submitted forms, which allows context-dependent users to obtain sensitive information such as usernames and passwords by reading the log file. El módulo BOTCHA Spam Prevention v7.x-1.x anterior a v7.x-1.6, v7.x-2.x anterior a v7.x-2.1, y v7.x-3.x anterior a v7.x-3.3 para Drupal, cuando el nivel de depuración se establece en 5 o 6, registra el contenido de los formularios enviados, lo que permite a los usuarios dependientes del contexto obtener información confidencial, como nombres de usuario y las contraseñas mediante la lectura del archivo de registro. • http://www.openwall.com/lists/oss-security/2013/08/22/2 https://drupal.org/node/2064781 https://drupal.org/node/2064783 https://drupal.org/node/2064785 https://drupal.org/node/2065057 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •