CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2007-5597
https://notcve.org/view.php?id=CVE-2007-5597
19 Oct 2007 — The hook_comments API in Drupal 4.7.x before 4.7.8 and 5.x before 5.3 does not pass publication status, which might allow attackers to bypass access restrictions and trigger e-mail with unpublished comments from some modules, as demonstrated by (1) Organic groups and (2) Subscriptions. El API hook_comments en el Drupal 4.7.x anterior al 4.7.8 y el 5.x anterior al 5.3 no pasa el estado de publicación, lo que puede permitir a atacantes evitar las restricciones de acceso y disparar un e-mail con comentarios no... • http://drupal.org/node/184354 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 4%CPEs: 1EXPL: 2CVE-2007-5416 – Drupal 5.2 - PHP Zend Hash ation Vector
https://notcve.org/view.php?id=CVE-2007-5416
12 Oct 2007 — Drupal 5.2 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code by invoking the drupal_eval function through a callback parameter to the default URI, as demonstrated by the _menu[callbacks][1][callback] parameter. NOTE: it could be argued that this vulnerability is due to a bug in the unset PHP command (CVE-2006-3017) and the proper fix should be... • https://www.exploit-db.com/exploits/4510 • CWE-189: Numeric Errors •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2007-4063
https://notcve.org/view.php?id=CVE-2007-4063
30 Jul 2007 — Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.2 allow remote attackers to (1) delete comments, (2) delete content revisions, and (3) disable menu items as privileged users, related to improper use of HTTP GET and the Forms API. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) de Drupal 5.x anterior a 5.2 permite a atacantes remotos (1) borrar comentarios, (2) borrar revisiones de contenido, y (3) deshabilitar elementos de menú como usuario... • http://drupal.org/files/sa-2007-017/advisory.txt •
CVSS: 4.8EPSS: 0%CPEs: 11EXPL: 0CVE-2007-4064
https://notcve.org/view.php?id=CVE-2007-4064
30 Jul 2007 — Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHP_SELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Drupal 5.x anterior a 5.2, y 4.7.x anterior a 4.7.7, (1) permiten a atacantes remotos inyectar... • http://drupal.org/files/sa-2007-018/advisory.txt • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 0CVE-2007-0658
https://notcve.org/view.php?id=CVE-2007-0658
01 Feb 2007 — The (1) Textimage 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal and the (2) Captcha 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal allow remote attackers to bypass the CAPTCHA test via an empty captcha element in $_SESSION. Los módulos para Drupal (1) Textimage 4.7.x versiones anteriores a 4.7-1.2 y 5.x versiones anteriores a 5.x-1.1 y (2) Captcha 4.7.x versiones anteriores a 4.7-1.2 y 5.x versiones anteriores a 5.x-1.1, permiten a atacantes remotos evitar la comprobación CAPT... • http://cvs.drupal.org/viewcvs/drupal/contributions/modules/captcha/captcha.module?r1=1.25.2.1&r2=1.25.2.2 •
CVSS: 9.8EPSS: 4%CPEs: 2EXPL: 0CVE-2007-0626
https://notcve.org/view.php?id=CVE-2007-0626
31 Jan 2007 — The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with "post comments" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by "normal form validation routines." La función comment_form_add_preview en comment.module en Drupal anterior a versión 4.7.6, y versión 5.x anterior a 5.1, y vbDrupal, permite a los atacantes remotos con privilegios de "post comm... • http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html •