CVSS: 4.3EPSS: 0%CPEs: 52EXPL: 0CVE-2016-7572
https://notcve.org/view.php?id=CVE-2016-7572
03 Oct 2016 — The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors. La ruta system.temporary en Drupal 8.x en versiones anteriores a 8.1.10 no valida adecuadamente el permiso para "Exportar configuración", lo que permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y leer una exportación de con... • http://www.securityfocus.com/bid/93101 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.8EPSS: 1%CPEs: 61EXPL: 0CVE-2016-6211
https://notcve.org/view.php?id=CVE-2016-6211
09 Sep 2016 — The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form. El módulo User en Drupal 7.x en versiones anteriores a 7.44 permite a usuarios remotos autenticados obtener privilegios a través de vectores relacionados relacionados con un código contribuido o personalizado que desencadena una reconstrucción de la forma del perfil del usuario. • http://www.debian.org/security/2016/dsa-3604 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 0%CPEs: 105EXPL: 0CVE-2016-6212
https://notcve.org/view.php?id=CVE-2016-6212
09 Sep 2016 — The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors. El módulo Views 7.x-3.x en versiones anteriores a 7.x-3.14 en Drupal 7.x y el módulo Views en Drupal 8.x en versiones anteriores a 8.1.3 podrían permitir a usuarios remotos autenticados eludir restricciones destinadas al acceso y obtener información de Statistic... • http://www.openwall.com/lists/oss-security/2016/07/13/4 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.1EPSS: 81%CPEs: 21EXPL: 0CVE-2016-5385 – PHP: sets environmental variable based on user supplied Proxy request header
https://notcve.org/view.php?id=CVE-2016-5385
19 Jul 2016 — PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issu... • http://lists.opensuse.org/opensuse-updates/2016-08/msg00003.html • CWE-20: Improper Input Validation CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 8.1EPSS: 0%CPEs: 63EXPL: 0CVE-2016-3162
https://notcve.org/view.php?id=CVE-2016-3162
12 Apr 2016 — The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files. El módulo File en Drupal 7.x en versiones anteriores a 7.43 y 8.x en versiones anteriores a 8.0.4 permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y leer, eliminar o sustituir un enlace a un arch... • http://www.debian.org/security/2016/dsa-3498 • CWE-284: Improper Access Control •
CVSS: 7.5EPSS: 0%CPEs: 106EXPL: 0CVE-2016-3163
https://notcve.org/view.php?id=CVE-2016-3163
12 Apr 2016 — The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method. El sistema XML-RPC en Drupal 6.x en versiones anteriores a 6.38 y 7.x en versiones anteriores a 7.43 podría hacer más fácil para atacantes remotos llevar a cabo ataques de fuerza bruta a través de una gran cantidad de llamadas realizadas a la vez al mismo método. • http://www.debian.org/security/2016/dsa-3498 • CWE-254: 7PK - Security Features •
CVSS: 7.4EPSS: 0%CPEs: 143EXPL: 0CVE-2016-3164
https://notcve.org/view.php?id=CVE-2016-3164
12 Apr 2016 — Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation. Drupal 6.x en versiones anteriores a 6.38, 7.x en versiones anteriores a 7.43 y 8.x en versiones anteriores a 8.0.4 podría permitir a atacantes remotos llevar a cabo ataques de redirección abierta aprovechando (1) código personalizado o (2) un formulario mostrado en un página de error 4... • http://www.debian.org/security/2016/dsa-3498 •
CVSS: 5.9EPSS: 0%CPEs: 49EXPL: 0CVE-2016-3166
https://notcve.org/view.php?id=CVE-2016-3166
12 Apr 2016 — CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers. Vulnerabilidad de inyección CRLF en la función drupal_set_header en Drupal 6.x en versiones anteriores a 6.38, cuando se utiliza con PHP en versiones anteriores a 5.1.2, permite a atacantes remotos inyectar... • http://www.debian.org/security/2016/dsa-3498 •
CVSS: 7.4EPSS: 0%CPEs: 48EXPL: 0CVE-2016-3167
https://notcve.org/view.php?id=CVE-2016-3167
12 Apr 2016 — Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter. Vulnerabilidad de redirección abierta en la función drupal_goto en Drupal 6.x en versiones anteriores a 6.38, cuando se utiliza con PHP en versiones anteriores a 5.4.7, permite a atacantes remotos redirigir a usuarios a sitios web arbitrarios y ... • http://www.debian.org/security/2016/dsa-3498 •
CVSS: 8.5EPSS: 0%CPEs: 107EXPL: 0CVE-2016-3168
https://notcve.org/view.php?id=CVE-2016-3168
12 Apr 2016 — The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability." El módulo System en Drupal 6.x en versiones anteriores a 6.38 y 7.x en versiones anteriores a 7.43 podría permitir a atacantes remotos secuestrar la autenticación de los administradores del sitio para peticiones que descargan y ejecutan archi... • http://www.debian.org/security/2016/dsa-3498 • CWE-254: 7PK - Security Features •