CVSS: 9.1EPSS: 0%CPEs: 32EXPL: 0CVE-2010-3685
https://notcve.org/view.php?id=CVE-2010-3685
29 Sep 2010 — The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. El módulo de OpenID en Drupal v6.x antes de v6.18, y el módulo de OpenID v5.x antes de v5.x-1.4 para Drupal, viola el protocolo OpenID v2.0, al no comprobar la reutilización de los valores openid.response_nonce, lo ... • http://drupal.org/node/880476 • CWE-287: Improper Authentication •
CVSS: 9.1EPSS: 0%CPEs: 32EXPL: 0CVE-2010-3686
https://notcve.org/view.php?id=CVE-2010-3686
29 Sep 2010 — The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. El módulo de OpenID en Drupal v6.x antes de v6.18, y el módulo de OpenID v5.x antes de v5.x-1.4 para Drupal, viola el protocolo OpenID v2.0, al no garantizar que los campos están firmados, lo cual permite a atacantes remotos evitar la... • http://drupal.org/node/880476 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 0%CPEs: 32EXPL: 0CVE-2010-3091
https://notcve.org/view.php?id=CVE-2010-3091
29 Sep 2010 — The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider. El módulo OpenID en Drupal v6.x anterior a v6.18, y el módulo OpenID v5.x anterior a v5.x-1.4 para Drupal, viola el protocolo OpenID v2.0, al no verificar el valor openid.return_to, lo cual permite a atacantes remotos evitar la a... • http://drupal.org/node/880476 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 55EXPL: 0CVE-2010-3092
https://notcve.org/view.php?id=CVE-2010-3092
21 Sep 2010 — The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name. El módulo de carga en Drupal v5.x anterior a v5.23 y v6.x anterior a v6.18 no soporta apropiadamente la manipulación de nombres de archivos insensibles a mayúsculas y minúsculas en la configuración de la base ... • http://drupal.org/node/880476 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.1EPSS: 0%CPEs: 55EXPL: 0CVE-2010-3093
https://notcve.org/view.php?id=CVE-2010-3093
21 Sep 2010 — The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue. El módulo comentario en Drupal v5.x anterior a v5.23 y v6.x anterior a v6.18 permite a usuarios autenticados remotamente con ciertos privilegios evitar restricciones de acceso pretendidas y restaurar comentarios eliminados a través de una URL manipulada, re... • http://drupal.org/node/880476 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.4EPSS: 0%CPEs: 27EXPL: 0CVE-2010-3094
https://notcve.org/view.php?id=CVE-2010-3094
21 Sep 2010 — Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the actions feature and the trigger module. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Drupal v6.x anterior a v6.18 permiten a usuarios autenticados remotamente con ciertos privilegios i... • http://drupal.org/node/880476 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 14EXPL: 0CVE-2009-4990
https://notcve.org/view.php?id=CVE-2009-4990
25 Aug 2010 — Cross-site scripting (XSS) vulnerability in the Webform report module 5.x and 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via a submission. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados en el módulo WebForm v5.x y v6.x para Drupal, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del envío de un formulario. • http://drupal.org/node/540980 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 34EXPL: 0CVE-2010-1958
https://notcve.org/view.php?id=CVE-2010-1958
21 Jun 2010 — Cross-site scripting (XSS) vulnerability in the FileField module 5.x before 5.x-2.5 and 6.x before 6.x-3.4 for Drupal allows remote authenticated users, with create or edit permissions and 'Path to File' or 'URL to File' display enabled, to inject arbitrary web script or HTML via the file name (filepath parameter). Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo FileField v5.x anteriores a v5.x-2.5 y v6.x anteriores a v6.x-3.4 para Drupal. Permite a usuarios remotos autenticad... • http://drupal.org/node/829808 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 23EXPL: 0CVE-2010-2353
https://notcve.org/view.php?id=CVE-2010-2353
21 Jun 2010 — The Node Reference module in Content Construction Kit (CCK) module 6.x before 6.x-2.7 for Drupal does not perform access checks for the source field in the backend URL for the autocomplete widget, which allows remote attackers to discover titles and IDs of controlled nodes. El módulo "Node Reference" (referencia de nodo) en el módulo "Content Construction Kit" (CCK o kit de construcción de contenido) v6.x en versiones anteriores a la v6.x-2.7 para Drupal no realiza comprobaciones de acceso para el campo "so... • http://drupal.org/node/829566 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.4EPSS: 0%CPEs: 34EXPL: 0CVE-2010-2000
https://notcve.org/view.php?id=CVE-2010-2000
20 May 2010 — Cross-site scripting (XSS) vulnerability in the Bibliography (Biblio) module 5.x through 5.x-1.17 and 6.x through 6.x-1.9 for Drupal allows remote authenticated users, with "administer biblio" privileges, to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-1358. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Bibliography (Biblio) módulo v5.x hasta v5.x-1.17 y v6.x hasta v6.x-1.9 para Drupal permite a usuarios autenticados en remoto co... • http://drupal.org/node/796498 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •