CVSS: 6.4EPSS: 0%CPEs: 22EXPL: 0CVE-2012-1635
https://notcve.org/view.php?id=CVE-2012-1635
The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content. La funcion hook_node_access en el módulo revisioning v7.x-1.x anterior a v7.x-1.3 para Drupal comprueba los permisos del usuario actual, incluso cuando se le llama para comprobar los permisos de otros usuarios, lo que permite a atacantes remotos evitar las restricciones de acceso, como se demuestra cuando se utiliza el módulo XML Sitemap para obtener información sensible acerca del contenido publicado. • http://drupal.org/node/1407456 http://www.openwall.com/lists/oss-security/2012/04/07/1 https://drupal.org/node/1409268 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.6EPSS: 0%CPEs: 3EXPL: 0CVE-2012-1645
https://notcve.org/view.php?id=CVE-2012-1645
The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php. El módulo CDN v6.x-2.2 y v7.x-2.2 para Drupal, cuando está en ejecución en modo Origin Pull con la opción "Far Future expiration" habilitada, permite a atacantes remotos leer ficheros PHP de su elección a través de vectores no especificados, como se ha demostrado leyendo settings.php. • http://drupal.org/node/1441480 http://drupal.org/node/1441482 http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff http://drupalcode.org/project/cdn.git/commitdiff/eca85e6 http://secunia.com/advisories/48032 http://www.openwall.com/lists/oss-security/2012/04/07/1 http://www.osvdb.org/79317 https://drupal.org/node/1441502 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0CVE-2012-2297
https://notcve.org/view.php?id=CVE-2012-2297
Multiple cross-site scripting (XSS) vulnerabilities in the Creative Commons module 6.x-1.x before 6.x-1.1 for Drupal allow remote authenticated users with the administer creative commons permission to inject arbitrary web script or HTML via the (1) creativecommons_user_message or (2) creativecommons_site_license_additional_text parameter. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en el módulo Creative Commons v6.x-1.x y anteriores a v6.x-1.1 para Drupal que permite a usuarios remotos autenticados con permisos de administración (creative commons) inyectar código web o HTML arbitrario a través del parámetro (1) creativecommons_user_message o (2) creativecommons_site_license_additional_text. • http://drupal.org/node/1547478 http://drupal.org/node/1547520 http://secunia.com/advisories/48937 http://www.madirish.net/content/drupal-creative-commons-6x-10-xss-vulnerability http://www.openwall.com/lists/oss-security/2012/05/03/1 http://www.openwall.com/lists/oss-security/2012/05/03/2 http://www.securityfocus.com/bid/53248 https://exchange.xforce.ibmcloud.com/vulnerabilities/75180 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2012-2073
https://notcve.org/view.php?id=CVE-2012-2073
The Bundle copy module 7.x-1.x before 7.x-1.1 for Drupal does not check for the "use PHP for settings" permission while importing settings, which allows remote authenticated users with certain permissions to execute arbitrary PHP code via unspecified vectors. El módulo de copia Bundle v7.x-1.x antes de v7.x-1.1 para Drupal no comprueba el permiso de uso de PHP para la configuración ('use PHP for settings') cuando importa una configuración, lo que permite ejecutar código PHP de su elección a usuarios remotos autenticados con determinados permisos a través de vectores no especificados. • http://drupal.org/node/1506166 http://drupal.org/node/1506420 http://drupalcode.org/project/bundle_copy.git/commit/299bdca http://osvdb.org/80676 http://secunia.com/advisories/48626 http://www.openwall.com/lists/oss-security/2012/04/07/1 http://www.securityfocus.com/bid/52811 https://exchange.xforce.ibmcloud.com/vulnerabilities/74439 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2012-2081
https://notcve.org/view.php?id=CVE-2012-2081
The Organic Groups (OG) module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access, which allows remote attackers to obtain sensitive information such as private group titles via a request through the Views module. El módulo 'Organic Groups' (OG) v6.x-2.x, antes de v6.x-2.3 para Drupal no restringe adecuadamente el acceso, lo que permite a atacantes remotos obtener información sensible, tales como títulos de los grupos privados a través de una solicitud a través del módulo de Vistas (Views). • http://drupal.org/node/1507328 http://drupal.org/node/1507446 http://osvdb.org/80678 http://secunia.com/advisories/48620 http://www.openwall.com/lists/oss-security/2012/04/07/1 http://www.securityfocus.com/bid/52799 https://exchange.xforce.ibmcloud.com/vulnerabilities/74526 • CWE-264: Permissions, Privileges, and Access Controls •