CVSS: 5.4EPSS: 0%CPEs: 40EXPL: 0CVE-2013-6387 – Mandriva Linux Security Advisory 2013-287-1
https://notcve.org/view.php?id=CVE-2013-6387
27 Nov 2013 — Cross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field. Vulnerabilidad de cross-site scripting (XSS) en el módulo Image en Drupal 7.x anteriores a 7.24 permite a usuarios autenticados remotamente con ciertos permisos inyectar scripts web o HTML arbitrarios a través del campo de descripción. Drupal core's Image module allows for the on-demand generation o... • http://www.debian.org/security/2013/dsa-2804 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2013-6388 – Mandriva Linux Security Advisory 2013-287-1
https://notcve.org/view.php?id=CVE-2013-6388
27 Nov 2013 — Cross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS. Vulnerabilidad de cross-site scripting (XSS) en el módulo Color en Drupal 7.x anteriores a 7.24 permite a atacantes remotos inyectar scripts web o HTML arbitrarios a través de vectores relacionados con CSS. Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requestin... • http://www.debian.org/security/2013/dsa-2804 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2013-6389 – Mandriva Linux Security Advisory 2013-287-1
https://notcve.org/view.php?id=CVE-2013-6389
27 Nov 2013 — Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Vulnerabilidad de redirección abierta en el módulo Overlay de Drupal 7.x anterior a la versión 7.24 permite a atacantes remotos redirigir a usuarios hacia sitios web arbitrarios y llevar a cabo ataques de phishing a través de vectores no especificados. Drupal core's Image module allows for the on-demand generation o... • http://www.debian.org/security/2013/dsa-2804 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 0CVE-2012-0827
https://notcve.org/view.php?id=CVE-2012-0827
28 Oct 2013 — The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors. El módulo de archivos en Drupal 7.x antes de 7.11, al utilizar campos de acceso no especificados a los modulos, permitiendo a usuarios remotos autenticados leer archivos privados arbitrarios que se asocian con campos restringidos a través de vectores no especificados. • https://drupal.org/node/1425084 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 72EXPL: 0CVE-2013-0244 – Debian Security Advisory 2776-1
https://notcve.org/view.php?id=CVE-2013-0244
11 Oct 2013 — Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements. Cross-site scripting (XSS) en Drupal 6.x anterior a 6.28 y 7.x anterior a 7.19, cuando se ejecuta con versiones anteriores de jQuery que son vulnerables a CVE-2011-4969, que permite a ata... • http://osvdb.org/89306 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 54EXPL: 0CVE-2012-0825 – Debian Security Advisory 2776-1
https://notcve.org/view.php?id=CVE-2012-0825
11 Oct 2013 — Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack. Drupal 6.x anterior a la versión 6.23 y 7.x anterior a 7.11 no verifica que la información Attribute Exchange (AX) se firme, lo que permite a atacantes remotos modificar información AX potencialmente sensible sin la detección a través de ataques man-in-the-middle (MI... • http://openid.net/2011/05/05/attribute-exchange-security-alert • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 0%CPEs: 59EXPL: 0CVE-2012-0826 – Debian Security Advisory 2776-1
https://notcve.org/view.php?id=CVE-2012-0826
11 Oct 2013 — Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors. Vulnerabilidad de Cross-site request forgery (CSRF) en el modulo Aggregator en Drupal 6.x anterior a 6.23 y 7.x anterior a 7.11 permite a atacantes remotos secuestrar la autenticación de... • http://www.debian.org/security/2013/dsa-2776 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 72EXPL: 0CVE-2013-0245 – Debian Security Advisory 2776-1
https://notcve.org/view.php?id=CVE-2013-0245
16 Jul 2013 — The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors. La versión amigable de la funcionalidad de impresión del módulo Book para Drupal no restringe adecuadamente el acceso al nodo del que es parte del esquema del módul... • http://osvdb.org/89305 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.4EPSS: 0%CPEs: 35EXPL: 0CVE-2013-0246
https://notcve.org/view.php?id=CVE-2013-0246
16 Jul 2013 — The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors. El módulo Image en Drupal v7.x anterior a v7.19, cuando un sistema de ficheros privado es utilizado, no restringe adecuadamente el acceso a imágenes derivadas, lo que permite a atacantes remotos leer imágenes derivadas de imágenes restringidas a través de vectores... • http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 36EXPL: 0CVE-2013-0316 – Mandriva Linux Security Advisory 2013-287-1
https://notcve.org/view.php?id=CVE-2013-0316
27 Mar 2013 — The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests. El módulo Image en Drupal v7.x antes v7.20 permite a atacantes remotos provocar una denegación de servicio (CPU y el consumo de espacio en disco) a través de un gran número de nuevas solicitudes derivantes . Drupal core's Image module allows for the on-demand generation of image derivatives. This capability can be abused by requesting... • http://drupal.org/SA-CORE-2013-002 • CWE-399: Resource Management Errors •