CVSS: 6.0EPSS: 0%CPEs: 34EXPL: 0CVE-2008-6383
https://notcve.org/view.php?id=CVE-2008-6383
SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en SpeedTech Organization y Resource Manager (Storm) 5.x anterior a 5.x-1.14 y 6.x anterior a 6.x-1.18, un módulo para Drupal; permite a usuarios autenticados en remoto con acceso al proyecto storm ejecutar comandos SQL de su elección a través de vectores no especificados. • http://drupal.org/node/342246 http://secunia.com/advisories/32978 http://www.securityfocus.com/bid/32626 https://exchange.xforce.ibmcloud.com/vulnerabilities/47077 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 18EXPL: 0CVE-2008-6170
https://notcve.org/view.php?id=CVE-2008-6170
Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados(XSS) en Drupal v5.x anterior a v5.12 v6.x anterior a v6.6, lo que permite a usuarios remotos autenticados con permisos para crear contenidos de libros o editar la jerarquía de nodos de los libros inyectar secuencias de comandos web o HTML a través de la pagina de titulo del libro. • http://drupal.org/node/324824 http://secunia.com/advisories/32297 http://secunia.com/advisories/32441 http://www.securityfocus.com/bid/31882 http://www.vupen.com/english/advisories/2008/2913 https://exchange.xforce.ibmcloud.com/vulnerabilities/46052 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.3EPSS: 1%CPEs: 18EXPL: 0CVE-2008-6171
https://notcve.org/view.php?id=CVE-2008-6171
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header. El archivo includes/bootstrap.inc en Drupal versiones 5.x anterior a 5.12 y versiones 6.x anterior a 6.6, cuando el servidor está configurado para "IP-based virtual hosts," permite a los atacantes remotos incluir y ejecutar archivos arbitrarios por medio del encabezado Host de HTTP. • http://drupal.org/files/sa-2008-067/SA-2008-067-5.11.patch http://drupal.org/node/324824 http://secunia.com/advisories/32389 http://secunia.com/advisories/32441 http://www.securityfocus.com/bid/31900 http://www.vupen.com/english/advisories/2008/2913 https://exchange.xforce.ibmcloud.com/vulnerabilities/46049 https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html • CWE-16: Configuration CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2008-6020
https://notcve.org/view.php?id=CVE-2008-6020
SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an exposed filter on CCK text fields." Vulnerabilidad de inyección SQL en el módulo Views del gestor de contenidos Drupal en las versiones v6.x anteriores a la v6.x-2.2. Permite a los usuarios remotos ejecutar código arbitrario SQL a través de vectores de ataque desconocidos relacionados con un filtro vulnerable en los campos de texto CCK. • http://drupal.org/node/347831 http://drupal.org/node/348321 http://osvdb.org/50795 http://secunia.com/advisories/33225 http://secunia.com/advisories/33289 http://www.securityfocus.com/bid/32895 https://exchange.xforce.ibmcloud.com/vulnerabilities/47454 https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01024.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 15EXPL: 0CVE-2008-5996
https://notcve.org/view.php?id=CVE-2008-5996
Cross-site scripting (XSS) vulnerability in the Simplenews module 5.x before 5.x-1.5 and 6.x before 6.x-1.0-beta4, a module for Drupal, allows remote authenticated users, with "administer taxonomy" permissions, to inject arbitrary web script or HTML via a Newsletter category field. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Simplenews v5.x anterior a v5.x-1.5 y v6.x previo a v6.x-1.0-beta4, para Drupal, permite a usuarios autenticados remotamente con "administrar taxonomy (administer taxonomy)" inyectar secuencias de comandos web o HTML de su elección a través de un campo de la categoría Newsletter. • http://drupal.org/node/312944 http://secunia.com/advisories/32022 http://www.securityfocus.com/bid/31377 https://exchange.xforce.ibmcloud.com/vulnerabilities/45407 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •