CVSS: 7.5EPSS: 0%CPEs: 53EXPL: 0CVE-2015-6659
https://notcve.org/view.php?id=CVE-2015-6659
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment. Vulnerabilidad de inyección SQL en el sistema de filtrado de comentarios en la API Database en Drupal 7.x en versiones anteriores a 7.39, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de un comentario SQL. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html http://www.debian.org&# • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.8EPSS: 0%CPEs: 99EXPL: 0CVE-2015-6660
https://notcve.org/view.php?id=CVE-2015-6660
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks." Vulnerabilidad en la API Form en Drupal 6.x en versiones anteriores a 6.37 y 7.x en versiones anteriores a 7.39, no valida correctamente el token form, lo cual permite a atacantes remotos realizar ataques CSRF que cargan archivos en diferentes cuentas de usuario a través de vectores relacionados con 'valores devueltos en la carga de archivo'. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html http://www.debian.org&# • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.0EPSS: 0%CPEs: 95EXPL: 0CVE-2015-6661
https://notcve.org/view.php?id=CVE-2015-6661
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. Vulnerabilidad en Drupal 6.x en versiones anteriores a 6.37 y 7.x en versiones anteriores a 7.39, permite a atacantes remotos obtener títulos sensibles de nodo leyendo el menú. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html http://www.debian.org&# • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 78EXPL: 0CVE-2015-6665
https://notcve.org/view.php?id=CVE-2015-6665
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag. Vulnerabilidad de XSS en el manejador Ajax en Drupal 7.x en versiones anteriores a la 7.39 y el módulo Ctools 6.x-1.x en versiones anteriores a 6.x-1.14 para Drupal, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores implicando un elemento HTML en la lista blanca, posiblemente relacionado con la etiqueta 'a'. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165674.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165695.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html http://lists.fedoraproject& • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.0EPSS: 0%CPEs: 53EXPL: 0CVE-2015-3231
https://notcve.org/view.php?id=CVE-2015-3231
The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache. El sistema de caché Render en Drupal 7.x anterior a 7.38, cuando se utiliza para cachear contenido por roles de usuario, permite a usuarios remotos autenticados obtener contenido privado visualizado por el usuario 1 mediante la lectura del caché. • http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161261.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161265.html http://www.debian.org/security/2015/dsa-3291 http://www.securityfocus.com/bid/75286 https://www.drupal.org/SA-CORE-2015-002 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •