CVSS: 5.8EPSS: 0%CPEs: 14EXPL: 0CVE-2008-3744
https://notcve.org/view.php?id=CVE-2008-3744
Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that (1) add or (2) delete user access rules. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en Drupal 5.x versiones anteriores a 5.10 y 6.x versiones anteriores a 6.4 permiten a atacantes remotos (1) añadir o (2) borrar reglas de acceso de usuarios como administradores a través de una URL sin especificar. • http://drupal.org/node/295053 http://secunia.com/advisories/31462 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44448 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 1%CPEs: 14EXPL: 0CVE-2008-3742
https://notcve.org/view.php?id=CVE-2008-3742
Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated. Vulnerabilidad de subida de ficheros sin restricción en el módulo BlogAPI de Drupal 5.x anterior a 5.10 y 6.x anterior a 6.4, permite a a usuarios autenticados en remotos ejecutar código de su elección mediante la subida de un fichero con la extensión de un ejecutable, lo cual no es validado. • http://drupal.org/node/295053 http://secunia.com/advisories/31462 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44447 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2008-3745
https://notcve.org/view.php?id=CVE-2008-3745
The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors. El módulo Upload en Drupal 6.x anterior a 6.4, permite a usuarios autenticados en remoto editar nodos, eliminar ficheros y descargar adjuntos no autorizados a través de vectores no especificados. • http://drupal.org/node/295053 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44458 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 14EXPL: 0CVE-2008-3741
https://notcve.org/view.php?id=CVE-2008-3741
The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML. El filesystem privado de Drupal 5.x versiones anteriores a la 5.10 y 6.x versiones anteriores a la 6.4, confía en el tipo MIME enviado por el navegador, lo cual permite a los usuarios remotos autenticados dirigir ataques de secuencias de comandos en sitios cruzados (XSS) subiendo ficheros que contienen arbitrariamente secuencias de comandos web o HTML. • http://drupal.org/node/295053 http://secunia.com/advisories/31462 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44446 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.8EPSS: 0%CPEs: 4EXPL: 0CVE-2008-3743
https://notcve.org/view.php?id=CVE-2008-3743
Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for (1) cached forms and (2) forms with AHAH elements. Múltiples vulnerabilidades de falsificación de petición en sitios cruzados (CSRF) en forms de Drupal 6.x antes de 6.4 permiten a atacantes remotos realizar acciones no especificadas mediante vectores desconocidos, relacionados a validaciones de testigo (token) incorrectas para (1) cached forms y (2) forms con elementos AHAH. • http://drupal.org/node/295053 http://secunia.com/advisories/31462 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44453 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-352: Cross-Site Request Forgery (CSRF) •