CVSS: 5.3EPSS: 0%CPEs: 94EXPL: 0CVE-2016-3170
https://notcve.org/view.php?id=CVE-2016-3170
12 Apr 2016 — The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in. Los enlaces de "has olvidado tu contraseña" en el módulo User en Drupal 7.x en versiones anteriores a 7.43 y 8.x en versiones anteriores a 8.0.4 permiten a atacantes remotos obtener información sensible de nombre de usuario ... • http://www.debian.org/security/2016/dsa-3498 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0CVE-2015-8095
https://notcve.org/view.php?id=CVE-2015-8095
09 Nov 2015 — The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern. La funcionalidad recycle bin en el módulo Monster Menus 7.x-1.21 en versiones anteriores a 7.x-1.24 para Drupal no elimina correctamente los nodos de la vista, lo que permite a atacantes remotos obtener información sensible a través de un patrón URL no especificado. • https://www.drupal.org/node/2608382 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2015-7876
https://notcve.org/view.php?id=CVE-2015-7876
21 Oct 2015 — The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the db_like function. La función escapeLike en sqlsrv/database.inc en el controlador de Drupal 7 para SQL Server y SQL Azure 7.x-1.x en versiones anteriores a 7.x-1.4 no escapa adecuadamente ciertos carácteres, lo que permite a atacantes remoto... • http://cgit.drupalcode.org/sqlsrv/commit/?id=2ea0da8 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 1%CPEs: 99EXPL: 0CVE-2015-6658 – Debian Security Advisory 3346-1
https://notcve.org/view.php?id=CVE-2015-6658
24 Aug 2015 — Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. Vulnerabilidad de XSS en el sistema Autocomplete en Drupal 6.x en versiones anteriores a 6.37 y 7.x en versiones anteriores a 7.39, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada, relacionado con la carga de archivos. Sev... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 99EXPL: 0CVE-2015-6660 – Debian Security Advisory 3346-1
https://notcve.org/view.php?id=CVE-2015-6660
24 Aug 2015 — The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks." Vulnerabilidad en la API Form en Drupal 6.x en versiones anteriores a 6.37 y 7.x en versiones anteriores a 7.39, no valida correctamente el token form, lo cual permite a atacantes remotos realizar ataques CSRF que cargan archivos en diferentes cuentas de... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 95EXPL: 0CVE-2015-6661 – Debian Security Advisory 3346-1
https://notcve.org/view.php?id=CVE-2015-6661
24 Aug 2015 — Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. Vulnerabilidad en Drupal 6.x en versiones anteriores a 6.37 y 7.x en versiones anteriores a 7.39, permite a atacantes remotos obtener títulos sensibles de nodo leyendo el menú. Several vulnerabilities were discovered in Drupal, a content management framework. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 1%CPEs: 78EXPL: 0CVE-2015-6665 – Debian Security Advisory 3346-1
https://notcve.org/view.php?id=CVE-2015-6665
24 Aug 2015 — Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag. Vulnerabilidad de XSS en el manejador Ajax en Drupal 7.x en versiones anteriores a la 7.39 y el módulo Ctools 6.x-1.x en versiones anteriores a 6.x-1.14 para Drupal, permite a atacantes remotos inyectar secuencias de coman... • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 10%CPEs: 53EXPL: 0CVE-2015-6659 – Debian Security Advisory 3346-1
https://notcve.org/view.php?id=CVE-2015-6659
24 Aug 2015 — SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment. Vulnerabilidad de inyección SQL en el sistema de filtrado de comentarios en la API Database en Drupal 7.x en versiones anteriores a 7.39, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de un comentario SQL. Several vulnerabilities were discovered in Drupal, a content management framework. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 53EXPL: 0CVE-2015-3231 – Debian Security Advisory 3291-1
https://notcve.org/view.php?id=CVE-2015-3231
18 Jun 2015 — The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache. El sistema de caché Render en Drupal 7.x anterior a 7.38, cuando se utiliza para cachear contenido por roles de usuario, permite a usuarios remotos autenticados obtener contenido privado visualizado por el usuario 1 mediante la lectura del caché. Several vulnerabilities were found in drupal7, a content management platfo... • http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 53EXPL: 0CVE-2015-3232 – Debian Security Advisory 3291-1
https://notcve.org/view.php?id=CVE-2015-3232
18 Jun 2015 — Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter. Vulnerabilidad de la redirección abierta en el módulo Field UI en Drupal 7.x anterior a 7.38 permite a atacantes remotos redirigir usuarios hacia sitios web arbitrarios y realizar ataques de phishing a través de una URL en el parámetro destinations. Several vulnerabilities were found in drupal7, a c... • http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html •