CVSS: 5.0EPSS: 0%CPEs: 4EXPL: 0CVE-2008-2771
https://notcve.org/view.php?id=CVE-2008-2771
The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attackers with "access content" permissions to bypass restrictions and modify the node hierarchy via unspecified attack vectors. El módulo Node Hierarchy 5.x anterior a 5.x-1.1 y 6.x anteriores a 6.x-1.0 para Drupal no implementa adecuadamente los controles de acceso, lo que permite a atacantes remotos con permiso de "acceso al contenido", evitar las restricciones y modificar la jerarquía a través de vectores de ataque indeterminados. • http://drupal.org/node/269473 http://secunia.com/advisories/30622 http://www.securityfocus.com/bid/29675 https://exchange.xforce.ibmcloud.com/vulnerabilities/43006 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 2EXPL: 0CVE-2008-1978
https://notcve.org/view.php?id=CVE-2008-1978
Cross-site scripting (XSS) vulnerability in the Ubercart 5.x before 5.x-1.0 rc3 module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via node titles related to unspecified product features, a different vector than CVE-2008-1428. Vulnerabilidad de secuencias de órdenes en sitios cruzados (XSS) en el módulo Ubercart 5.x anteriores a 5.x-1.0 rc3 de Drupal permite a usuarios remotos autenticados inyectar 'script' web o HTML de su elección mediante títulos de nodos relacionados con características del producto no especificadas, un vector distinto de CVE-2008-1428. • http://drupal.org/node/250343 http://secunia.com/advisories/29950 http://www.securityfocus.com/bid/28914 http://www.vupen.com/english/advisories/2008/1351/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41975 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2008-1980
https://notcve.org/view.php?id=CVE-2008-1980
Cross-site scripting (XSS) vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de órdenes (XSS) en el módulo de Drupal "E-Publish" 5.x anteriores a 5.x-1.1 y 6.x anteriores a 6.x-1.0 beta1, permite a atacantes remotos inyectar 'script' web o HTML de su elección mediante vectores no especificados. • http://drupal.org/node/250408 http://secunia.com/advisories/29960 http://www.vupen.com/english/advisories/2008/1353/references https://exchange.xforce.ibmcloud.com/vulnerabilities/41979 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.6EPSS: 0%CPEs: 2EXPL: 0CVE-2008-0274
https://notcve.org/view.php?id=CVE-2008-0274
Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files. Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en Drupal 4.7.x y 5.x, cuando ciertas protecciones .htaccess son desactivadas, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de enlaces manipulados afectando a los archivos del tema .tpl.php. • http://drupal.org/node/208565 http://secunia.com/advisories/28422 http://secunia.com/advisories/28486 http://www.securityfocus.com/bid/27238 http://www.vbdrupal.org/forum/showthread.php?p=6878 http://www.vbdrupal.org/forum/showthread.php?t=1349 http://www.vupen.com/english/advisories/2008/0127 http://www.vupen.com/english/advisories/2008/0134 https://exchange.xforce.ibmcloud.com/vulnerabilities/39605 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 48EXPL: 0CVE-2008-0272
https://notcve.org/view.php?id=CVE-2008-0272
Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el módulo aggregator en Drupal 4.7.x anterior a 4.7.11 y 5.x anterior a 5.6 permite a atacantes remotos borrar campos desde un alimentador con privilegios de usuario. • http://drupal.org/node/208562 http://secunia.com/advisories/28422 http://secunia.com/advisories/28486 http://www.securityfocus.com/bid/27238 http://www.vbdrupal.org/forum/showthread.php?p=6878 http://www.vbdrupal.org/forum/showthread.php?t=1349 http://www.vupen.com/english/advisories/2008/0127 http://www.vupen.com/english/advisories/2008/0134 https://exchange.xforce.ibmcloud.com/vulnerabilities/39617 • CWE-352: Cross-Site Request Forgery (CSRF) •