CVSS: 7.5EPSS: 2%CPEs: 7EXPL: 0CVE-2008-1731
https://notcve.org/view.php?id=CVE-2008-1731
The Simple Access module for Drupal 5.x through 5.x-1.2-2 does not properly handle the privacy information for nodes, which might allow remote attackers to bypass intended access restrictions, and read or modify nodes, in opportunistic circumstances related to interaction between Simple Access and (1) Node clone or (2) Project issue tracking. El módulo de Acceso Simple para Drupal 5.x a 5.x-1.2-2 no manipula adecuadamente la información privada para nodos, que podría permitir a atacantes remotos evitar las restricciones de acceso planeadas, y leer o modificar nodos, en circunstancias oportunas relacionadas con la interacción entre Acceso Simple y (1) Node clone o (2) asuntos de seguimiento de Proyecto. • http://drupal.org/node/244560 http://secunia.com/advisories/29772 http://www.osvdb.org/44271 http://www.securityfocus.com/bid/28720 http://www.vupen.com/english/advisories/2008/1184 https://exchange.xforce.ibmcloud.com/vulnerabilities/41756 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2008-0276
https://notcve.org/view.php?id=CVE-2008-0276
Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via a site variable, related to lack of escaping of the variable table. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en el módulo Devel anterior a 5.x-0.1 para Drupal permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la variable site, Relacionado con la falta de escape de la variable tabla. • http://drupal.org/node/208524 https://exchange.xforce.ibmcloud.com/vulnerabilities/39606 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2008-0272
https://notcve.org/view.php?id=CVE-2008-0272
Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el módulo aggregator en Drupal 4.7.x anterior a 4.7.11 y 5.x anterior a 5.6 permite a atacantes remotos borrar campos desde un alimentador con privilegios de usuario. • http://drupal.org/node/208562 http://secunia.com/advisories/28422 http://secunia.com/advisories/28486 http://www.securityfocus.com/bid/27238 http://www.vbdrupal.org/forum/showthread.php?p=6878 http://www.vbdrupal.org/forum/showthread.php?t=1349 http://www.vupen.com/english/advisories/2008/0127 http://www.vupen.com/english/advisories/2008/0134 https://exchange.xforce.ibmcloud.com/vulnerabilities/39617 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2008-0273
https://notcve.org/view.php?id=CVE-2008-0273
Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism. Conflicto de interpretación en Drupal 4.7.x anterior a 4.7.11 y 5.x anterior a 5.6, cuando se utiliza Internet Explorer 6, permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados a través de secuencias de bytes UTF-8 no válidas, las cuales no son procesadas como UTF-8 por el filtro HTML de Drupal, pero son procesadas por UTF-8 por el Internet Explorer, eliminando los caracteres del documento HTML y derrotando el mecanismo de protección. • http://drupal.org/node/208564 http://secunia.com/advisories/28422 http://secunia.com/advisories/28486 http://www.securityfocus.com/bid/27238 http://www.vbdrupal.org/forum/showthread.php?p=6878 http://www.vbdrupal.org/forum/showthread.php?t=1349 http://www.vupen.com/english/advisories/2008/0127 http://www.vupen.com/english/advisories/2008/0134 https://exchange.xforce.ibmcloud.com/vulnerabilities/39619 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0274
https://notcve.org/view.php?id=CVE-2008-0274
Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en Drupal 4.7.x y 5.x, cuando ciertas protecciones .htaccess son desactivadas, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de enlaces manipulados afectando a los archivos del tema .tpl.php. • http://drupal.org/node/208565 http://secunia.com/advisories/28422 http://secunia.com/advisories/28486 http://www.securityfocus.com/bid/27238 http://www.vbdrupal.org/forum/showthread.php?p=6878 http://www.vbdrupal.org/forum/showthread.php?t=1349 http://www.vupen.com/english/advisories/2008/0127 http://www.vupen.com/english/advisories/2008/0134 https://exchange.xforce.ibmcloud.com/vulnerabilities/39605 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •