CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2012-1636
https://notcve.org/view.php?id=CVE-2012-1636
Cross-site request forgery (CSRF) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of users for requests that delete stickynotes via unspecified vectors. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el módulo stickynote anteriores a v7.x-1.1 para Drupal, permite a atacantes remotos secuestrar la autenticación de usuarios para peticiones que que borrar stickynotes a través de vectores no especificados. • http://drupal.org/node/1408556 http://drupal.org/node/1409422 http://drupalcode.org/project/stickynote.git/commit/9a7b535 http://secunia.com/advisories/47650 http://www.openwall.com/lists/oss-security/2012/04/07/1 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.5EPSS: 0%CPEs: 15EXPL: 0CVE-2012-1639
https://notcve.org/view.php?id=CVE-2012-1639
Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en el módulo enproduct/commerce_product.module en el módulo Drupal Commerce para Drupal anteriores a v7.x-1.2, permite a atacantes remotos secuestrar la autenticación de los usuarios para inyectar comandos web o html a través de los parámetros (1) sku o (2) title. • http://drupal.org/node/1416824 http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module http://osvdb.org/78528 http://secunia.com/advisories/47730 http://www.openwall.com/lists/oss-security/2012/04/07/1 http://www.securityfocus.com/bid/51668 https://exchange.xforce.ibmcloud.com/vulnerabilities/72743 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 30EXPL: 0CVE-2012-2153
https://notcve.org/view.php?id=CVE-2012-2153
Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page. Drupal 7.x anterior a 7.14 no restringe el acceso de forma adecuada a nodos en un listado cuando es usado "contributed node access module", lo que permite a usuarios autenticados de forma remota con "Acceso al contenido de la página" con permiso de lectura de nodos publicados accediendo a la página admin/content. • http://drupal.org/drupal-7.14 http://drupal.org/node/1557938 http://drupal.org/node/1558478 http://drupalcode.org/project/drupal.git/commit/c6d2b8311b82fe78d18732f01a68ceca3dea50af http://secunia.com/advisories/49012 http://www.mandriva.com/security/advisories?name=MDVSA-2013:074 http://www.securityfocus.com/bid/53362 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 15EXPL: 0CVE-2012-1646
https://notcve.org/view.php?id=CVE-2012-1646
Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo FAQ v6.x-1.x antes de v6.x-1.13 y v7.x-1.x-rc1 para Drupal, permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML a través del parámetro (1) title en faq.admin.inc o (2) el parámetro detailed_question en faq.module. • http://drupal.org/node/1451194 http://drupalcode.org/project/faq.git/blobdiff/2991dd94e70a2881571a4b777645f4dcc42c1f10..912f1d2:/faq.module http://drupalcode.org/project/faq.git/blobdiff/525fb85e5a43cb6cfe3028aa88eaf8a6e40548d5..f381756:/faq.admin.inc http://drupalcode.org/project/faq.git/commit/912f1d2 http://drupalcode.org/project/faq.git/commit/f381756 http://osvdb.org/79466 http://secunia.com/advisories/48131 http://www.openwall.com/lists/oss-security/2012/04/07/1 http://www.securityfocus. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 9EXPL: 0CVE-2011-5189
https://notcve.org/view.php?id=CVE-2011-5189
Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Webform Validation v6.x-1.x anterior a v6.x-1.5 y v7.x-1.x anterior a v7.x-1.1 para Drupal, permite a usuarios remotos autenticados con permisos para "actualizar nodos Webform" inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados. • http://drupal.org/node/1357354 http://drupal.org/node/1357356 http://drupal.org/node/1357360 http://secunia.com/advisories/47035 http://www.osvdb.org/77426 https://exchange.xforce.ibmcloud.com/vulnerabilities/71597 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •