CVSS: 6.0EPSS: 0%CPEs: 13EXPL: 0CVE-2008-4789
https://notcve.org/view.php?id=CVE-2008-4789
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error." La funcionalidad de validación del núcleo del módulo de subida en Drupal 6.x anterior a 6.5 permite a un usuario remoto autentificado sobrepasar las restricciones de acceso y "añadir archivos al contenido"; está relacionado con un "error lógico". • http://drupal.org/node/318706 http://secunia.com/advisories/32198 http://www.openwall.com/lists/oss-security/2008/10/21/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/45755 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 15EXPL: 0CVE-2008-4793
https://notcve.org/view.php?id=CVE-2008-4793
The node module API in Drupal 5.x before 5.11 allows remote attackers to bypass node validation and have unspecified other impact via unknown vectors related to contributed modules. El API del módulo nodo en Drupal 5.x anterior a 5.11 permite a un atacante remoto evitar la validación del nodo, y tiene otros impactos por medio de ataques desconocidos relacionados con los módulos contribuídos. • http://drupal.org/node/318706 http://secunia.com/advisories/32200 http://www.openwall.com/lists/oss-security/2008/10/21/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/45763 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.0EPSS: 0%CPEs: 8EXPL: 0CVE-2008-4633
https://notcve.org/view.php?id=CVE-2008-4633
SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again" is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to a "previously cast vote." Vulnerabilidad de inyección SQL en Node Vote v5.x anteriores a v5.x-1.1 y v6.x anteriores a v6.x-1.0, en un módulo de Drupal, cuando está habilitada la opción "Allow user to vote again", permite a usuarios autenticados remotos ejecutar comandos SQL de su elección mediante vectores no especificados relacionados con "previously cast vote" (votación anterior). • http://drupal.org/node/321685 http://secunia.com/advisories/32276 http://www.securityfocus.com/bid/31779 https://exchange.xforce.ibmcloud.com/vulnerabilities/45920 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1978
https://notcve.org/view.php?id=CVE-2008-1978
Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features, a different vector than CVE-2008-1428. Vulnerabilidad de secuencias de órdenes en sitios cruzados (XSS) en el módulo Ubercart 5.x anteriores a 5.x-1.0 rc3 de Drupal permite a usuarios remotos autenticados inyectar 'script' web o HTML de su elección mediante títulos de nodos relacionados con características del producto no especificadas, un vector distinto de CVE-2008-1428. • http://drupal.org/node/250343 http://secunia.com/advisories/29950 http://www.securityfocus.com/bid/28914 http://www.vupen.com/english/advisories/2008/1351/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41975 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-1980
https://notcve.org/view.php?id=CVE-2008-1980
Cross-site scripting (XSS) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de órdenes (XSS) en el módulo de Drupal "E-Publish" 5.x anteriores a 5.x-1.1 y 6.x anteriores a 6.x-1.0 beta1, permite a atacantes remotos inyectar 'script' web o HTML de su elección mediante vectores no especificados. • http://drupal.org/node/250408 http://secunia.com/advisories/29960 http://www.vupen.com/english/advisories/2008/1353/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41979 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •