CVSS: 4.3EPSS: 0%CPEs: 35EXPL: 0CVE-2013-0246
https://notcve.org/view.php?id=CVE-2013-0246
The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors. El módulo Image en Drupal v7.x anterior a v7.19, cuando un sistema de ficheros privado es utilizado, no restringe adecuadamente el acceso a imágenes derivadas, lo que permite a atacantes remotos leer imágenes derivadas de imágenes restringidas a través de vectores no especificados. • http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html http://seclists.org/fulldisclosure/2013/Jan/120 http://seclists.org/oss-sec/2013/q1/211 http://secunia.com/advisories/51717 https://drupal.org/SA-CORE-2013-001 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2013-1907
https://notcve.org/view.php?id=CVE-2013-1907
The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors. El módulo Commons Group anterior a 7.x-3.1 para Drupal utilizado en el módulo Commons anterior a 7.x-3.1, no restringe adecuadamente el acceso a los grupos, lo que permite a atacantes remotos la publicación de contenido arbitrario a través de vectores no especificados. • http://osvdb.org/91748 http://packetstormsecurity.com/files/120991/Drupal-Common-Groups-7.x-Access-Bypass-Privilege-Escalation.html http://seclists.org/fulldisclosure/2013/Mar/242 http://secunia.com/advisories/52769 http://secunia.com/advisories/52795 https://drupal.org/node/1954762 https://drupal.org/node/1954764 https://drupal.org/node/1954948 https://exchange.xforce.ibmcloud.com/vulnerabilities/83133 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 72EXPL: 0CVE-2013-0245
https://notcve.org/view.php?id=CVE-2013-0245
The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors. La versión amigable de la funcionalidad de impresión del módulo Book para Drupal no restringe adecuadamente el acceso al nodo del que es parte del esquema del módulo Book, lo que permite a usuarios autenticados remotamente con acceso a esta aplicación, permiso de lectura sobre los títulos y posiblemente al contenido del nodo a través de vectores no especificados. • http://osvdb.org/89305 http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html http://seclists.org/fulldisclosure/2013/Jan/120 http://seclists.org/oss-sec/2013/q1/211 http://secunia.com/advisories/51717 http://www.debian.org/security/2013/dsa-2776 https://drupal.org/SA-CORE-2013-001 https://exchange.xforce.ibmcloud.com/vulnerabilities/81380 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 0CVE-2013-1908
https://notcve.org/view.php?id=CVE-2013-1908
The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors. El módulo Commons Wikis anterior a v7.x-3.1 para Drupal, como se utiliza en el módulo Commons anterior a v7.x-3.1, no restringe correctamente el acceso a grupos, lo que permite a ataques remotos poner contenido arbitrario a grupos mediante vectores no especificados. • http://osvdb.org/91747 http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html http://seclists.org/fulldisclosure/2013/Mar/244 http://secunia.com/advisories/52766 http://secunia.com/advisories/52795 https://drupal.org/node/1954766 https://drupal.org/node/1954768 https://drupal.org/node/1954948 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2013-2122
https://notcve.org/view.php?id=CVE-2013-2122
The Edit Limit module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to comments, which allows remote authenticated users with the "edit comments" permission to edit arbitrary comments of other users via unspecified vectors. El módulo Edit Limit v7.x-1.x anterior a v7.x-1.3 para Drupal no restringe adecuadamente el acceso a los comentarios, permitiendo a usuarios remotos autenticados con los permisos "edit comments" editar los comentarios arbitrarias de otros usuarios a través de vectores no especificados. • http://osvdb.org/93725 http://seclists.org/fulldisclosure/2013/May/208 http://secunia.com/advisories/53556 http://www.openwall.com/lists/oss-security/2013/05/29/9 http://www.securityfocus.com/bid/60209 https://drupal.org/node/2006188 https://drupal.org/node/2007048 https://exchange.xforce.ibmcloud.com/vulnerabilities/84630 • CWE-264: Permissions, Privileges, and Access Controls •