CVSS: 5.0EPSS: 0%CPEs: 3EXPL: 0CVE-2012-3798
https://notcve.org/view.php?id=CVE-2012-3798
The Janrain Capture module 6.x-1.0 and 7.x-1.0 for Drupal, when creating a local user account, allows attackers to obtain part of the initial input used to generate passwords, which makes it easier to conduct brute force password guessing attacks. El módulo Janrain Capture v6.x-1.0 y v7.x-1.0 para Drupal, cuando está creando una cuenta de de usuario local, permite a atacantes a obtener parte de la entrada inicial usada, lo que facilita conducir un ataque de fuerza bruta a la cuenta de invitado. • http://drupal.org/node/1632702 http://drupal.org/node/1632704 http://drupal.org/node/1632734 http://osvdb.org/82957 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 0CVE-2012-2720
https://notcve.org/view.php?id=CVE-2012-2720
The Token Authentication (tokenauth) module 6.x-1.x before 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote attackers to perform requests with extra privileges. El token de autenticación (tokenauth) módulo v6.x-1.x anterior a v6.x-1.7 para Drupal no vuelve las sesiones de usuario correcatmente, permitiendo a atacantes remotos realizar las solicitudes con privilegios adicionales. • http://drupal.org/node/1618476 http://drupal.org/node/1619808 http://secunia.com/advisories/49400 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.osvdb.org/82727 http://www.securityfocus.com/bid/53840 https://exchange.xforce.ibmcloud.com/vulnerabilities/76141 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 0%CPEs: 6EXPL: 0CVE-2012-2729
https://notcve.org/view.php?id=CVE-2012-2729
Multiple cross-site request forgery (CSRF) vulnerabilities in the SimpleMeta module 6.x-1.x before 6.x-2.0 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) delete or (2) add a meta tag entry. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF)en el módulo SimpleMeta v6.x-1.x anteriores a v6.x-2.0 para Drupal, permite a atacantes remotos secuestrar la autenticación de los administradores para peticiones de (1) borrado o (2) añadir una entrada "meta tag". • http://drupal.org/node/1534874 http://drupal.org/node/1632908 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.securityfocus.com/bid/53997 https://exchange.xforce.ibmcloud.com/vulnerabilities/76344 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.8EPSS: 3%CPEs: 9EXPL: 1CVE-2012-2721
https://notcve.org/view.php?id=CVE-2012-2721
The default views in the Organic Groups (OG) module 6.x-2.x before 6.x-2.4 for Drupal do not properly check permissions when all users have the "access content" permission removed, which allows remote attackers to bypass access restrictions and possibly have other unspecified impact. La vista por defecto en el módulo Organic Groups (OG) v6.x-2.x anteriores a v6.x-2.4 para Drupal no comprueba de forma adecuada los permisos cuando todos los usuario tienen eliminado el permiso de acceso al contenido (access content), lo que permite a atacantes remotos evitar los restricciones y posiblemente tenga otros impactos no determinados. • http://drupal.org/node/1619736 http://drupal.org/node/1619810 http://drupalcode.org/project/og.git/commitdiff/1485708 http://secunia.com/advisories/49397 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.osvdb.org/82728 http://www.securityfocus.com/bid/53838 https://exchange.xforce.ibmcloud.com/vulnerabilities/76150 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.1EPSS: 0%CPEs: 5EXPL: 0CVE-2012-2705
https://notcve.org/view.php?id=CVE-2012-2705
The filter_titles function in the Smart Breadcrumb module 6.x-1.x before 6.x-1.3 for Drupal does not properly convert a title to plain-text, which allows remote authenticated users with create or edit node permissions to conduct cross-site scripting (XSS) attacks via the title parameter. La función filter_titles en el módulo Smart Breadcrumb v6.x-1.x anterior a v6.x-1.3 para Drupal no convierte correctamente un título a texto sin formato, permitiendo a usuarios remotos autenticados crear o editar los permisos de los nodos para realizar ataques XSS a través del parámetro title. • http://drupal.org/node/1568216 http://drupal.org/node/1585564 http://drupalcode.org/project/smart_breadcrumb.git/commitdiff/834f75a http://secunia.com/advisories/49163 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.osvdb.org/82006 http://www.securityfocus.com/bid/53592 https://exchange.xforce.ibmcloud.com/vulnerabilities/75713 • CWE-20: Improper Input Validation •