CVSS: 9.3EPSS: 1%CPEs: 18EXPL: 0CVE-2008-6171
https://notcve.org/view.php?id=CVE-2008-6171
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header. El archivo includes/bootstrap.inc en Drupal versiones 5.x anterior a 5.12 y versiones 6.x anterior a 6.6, cuando el servidor está configurado para "IP-based virtual hosts," permite a los atacantes remotos incluir y ejecutar archivos arbitrarios por medio del encabezado Host de HTTP. • http://drupal.org/files/sa-2008-067/SA-2008-067-5.11.patch http://drupal.org/node/324824 http://secunia.com/advisories/32389 http://secunia.com/advisories/32441 http://www.securityfocus.com/bid/31900 http://www.vupen.com/english/advisories/2008/2913 https://exchange.xforce.ibmcloud.com/vulnerabilities/46049 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html • CWE-16: Configuration CWE-20: Improper Input Validation •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0603
https://notcve.org/view.php?id=CVE-2009-0603
Cross-site scripting (XSS) vulnerability in index.php in the Link module 5.x-2.5 for Drupal 5.10 allows remote authenticated users, with "administer content types" privileges, to inject arbitrary web script or HTML via the description parameter (aka the Help field). NOTE: some of these details are obtained from third party information. Una vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados(XSS) en index.php en el módulo Link 5.x-2.5 para Drupal 5.10 permite inyectar, a los usuarios remotos autenticados (con privilegios para "administrar los tipos de contenido"), HTML o scripts Web arbitrarios a través del parámetro descripción (alias el campo Help). NOTA: Algunos de estos detalles se obtienen a partir de información de terceros. • http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0036.html http://osvdb.org/51780 http://secunia.com/advisories/33835 http://www.securityfocus.com/bid/33642 https://exchange.xforce.ibmcloud.com/vulnerabilities/48553 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 15EXPL: 0CVE-2008-4790
https://notcve.org/view.php?id=CVE-2008-4790
The core upload module in Drupal 5.x before 5.11 allows remote authenticated users to bypass intended access restrictions and read "files attached to content" via unknown vectors. El módulo central de subidas de Drupal 5.x Anterior a 5.11 permite a un usuario remoto autentificado sobrepasar las restricciones de acceso y leer "archivos adjuntos al contenido" mediante un método desconocido. • http://drupal.org/node/318706 http://secunia.com/advisories/32198 http://secunia.com/advisories/32200 http://www.openwall.com/lists/oss-security/2008/10/21/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/45758 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.0EPSS: 0%CPEs: 13EXPL: 0CVE-2008-4789
https://notcve.org/view.php?id=CVE-2008-4789
The validation functionality in the core upload module in Drupal 6.x before 6.5 allows remote authenticated users to bypass intended access restrictions and "attach files to content," related to a "logic error." La funcionalidad de validación del núcleo del módulo de subida en Drupal 6.x anterior a 6.5 permite a un usuario remoto autentificado sobrepasar las restricciones de acceso y "añadir archivos al contenido"; está relacionado con un "error lógico". • http://drupal.org/node/318706 http://secunia.com/advisories/32198 http://www.openwall.com/lists/oss-security/2008/10/21/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/45755 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 0CVE-2008-4792
https://notcve.org/view.php?id=CVE-2008-4792
The core BlogAPI module in Drupal 5.x before 5.11 and 6.x before 6.5 does not properly validate unspecified content fields of an internal Drupal form, which allows remote authenticated users to bypass intended access restrictions via modified field values. El núcleo del módulo BlogAPI de Drupal 5.x anterior a 5.11 y de 6.x anterior a 6.5 no validad correctamente campos de contenido sin especificar de un formulario interno de drupal, lo que permite a un usuario remoto autentificado evitar las restricciones de acceso por medio de valores de campos modificados. • http://drupal.org/node/318706 http://secunia.com/advisories/32201 http://www.openwall.com/lists/oss-security/2008/10/21/7 https://exchange.xforce.ibmcloud.com/vulnerabilities/45761 • CWE-264: Permissions, Privileges, and Access Controls •