CVSS: 5.4EPSS: 0%CPEs: 6EXPL: 0CVE-2007-5228
https://notcve.org/view.php?id=CVE-2007-5228
05 Oct 2007 — Cross-site scripting (XSS) vulnerability in the subscription functionality in the Project issue tracking module before 4.7.x-1.5, 4.7.x-2.x before 4.7.x-2.5, and 5.x-1.x before 5.x-1.1 for Drupal allows remote authenticated users with project create or edit permissions to inject arbitrary web script or HTML via unspecified vectors involving a (1) individual or (2) overview form. Vulnerabilidad de secuencia de comandos wn sitios cruzados (XSS) en la funcionalidad subscription en el asunto Project siguiendo e... • http://drupal.org/node/180568 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 11EXPL: 0CVE-2007-4064
https://notcve.org/view.php?id=CVE-2007-4064
30 Jul 2007 — Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Drupal 5.x anterior a 5.2, y 4.7.x anterior a 4.7.7, (1) permiten a atacantes remotos inyectar... • http://drupal.org/files/sa-2007-018/advisory.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2007-1368
https://notcve.org/view.php?id=CVE-2007-1368
09 Mar 2007 — The Project issue tracking module before 4.7.x-1.3, 4.7.x-2.* before 4.7.x-2.3, and 5 before 5.x-0.2-beta for Drupal allows remote authenticated users, with "access project issues" permission, to read the contents of a private node via a URL with a modified node identifier. El módulo Project anterior 4.7.x-1.3, 4.7.x-2.* anterior a 4.7.x-2.3, y 5 anterior 5.x-0.2-beta para Drupal permite a usuarios remotos validados, con permisos "asuntos de acceso a proyecto", leer el contenido de un nodo privado a través ... • http://drupal.org/node/125832 •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2007-0658
https://notcve.org/view.php?id=CVE-2007-0658
01 Feb 2007 — The (1) Textimage 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal and the (2) Captcha 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal allow remote attackers to bypass the CAPTCHA test via an empty captcha element in $_SESSION. Los módulos para Drupal (1) Textimage 4.7.x versiones anteriores a 4.7-1.2 y 5.x versiones anteriores a 5.x-1.1 y (2) Captcha 4.7.x versiones anteriores a 4.7-1.2 y 5.x versiones anteriores a 5.x-1.1, permiten a atacantes remotos evitar la comprobación CAPT... • http://cvs.drupal.org/viewcvs/drupal/contributions/modules/captcha/captcha.module?r1=1.25.2.1&r2=1.25.2.2 •
CVSS: 9.8EPSS: 4%CPEs: 2EXPL: 0CVE-2007-0626
https://notcve.org/view.php?id=CVE-2007-0626
31 Jan 2007 — The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines." La función comment_form_add_preview en comment.module en Drupal anterior a versión 4.7.6, y versión 5.x anterior a 5.1, y vbDrupal, permite a los atacantes remotos con privilegios de "post comm... • http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2007-0136
https://notcve.org/view.php?id=CVE-2007-0136
09 Jan 2007 — Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules. NOTE: some of these details are obtained from third party information. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Drupal anterior 4.6.11, y 4.7 anterior 4.7.5, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de p... • http://drupal.org/files/sa-2007-001/advisory.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 18EXPL: 1CVE-2007-0124
https://notcve.org/view.php?id=CVE-2007-0124
09 Jan 2007 — Unspecified vulnerability in Drupal before 4.6.11, and 4.7 before 4.7.5, when MySQL is used, allows remote authenticated users to cause a denial of service by poisoning the page cache via unspecified vectors, which triggers erroneous 404 HTTP errors for pages that exist. Vulnerabilidad no especificada en Drupal anterior a 4.6.11, y 4.7 anterior a 4.7.5, cuando se utiliza MySQL, permite a usuarios autenticados remotamente provocar una denegación de servicio modificando la caché de la página a través de vecto... • http://drupal.org/node/104238 •
CVSS: 6.8EPSS: 0%CPEs: 7EXPL: 0CVE-2006-6646
https://notcve.org/view.php?id=CVE-2006-6646
20 Dec 2006 — Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the check_plain function. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Drupal (1)Project Issue Tracking 4.7.x-1.0 y 4.7.x-2.0 y (2) Project 4.6.x-1.0, 4.7.x-1.0 y 4.7.x-2.0 permite a atacantes remotos la inyección d... • http://drupal.org/node/103943 •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2006-6647
https://notcve.org/view.php?id=CVE-2006-6647
20 Dec 2006 — Cross-site scripting (XSS) vulnerability in the MySite 4.7.x before 4.7.x-3.3 and 5.x before 5.x-1.3 module for Drupal allows remote attackers to inject arbitrary web script or HTML via the Title field when editing a page. NOTE: some details were obtained from third party information. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en MySite 4.7.x en versiones anteriores a la 4.7.x-3.3 y 5.x anteriores al módulo 5.x-1.3 para el Drupal permite a atacantes remotos la inyección de secuencias ... • http://drupal.org/node/103958 •
CVSS: 6.8EPSS: 1%CPEs: 14EXPL: 0CVE-2006-5475
https://notcve.org/view.php?id=CVE-2006-5475
24 Oct 2006 — Multiple cross-site scripting (XSS) vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el analizador XML en Drupal 4.6.x anterior a la 4.6.10 y 4.7.x anterior a la 4.7.4 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante una fuente RSS artesanal. • http://drupal.org/node/88826 •