CVSS: 6.8EPSS: 0%CPEs: 3EXPL: 1CVE-2012-2716
https://notcve.org/view.php?id=CVE-2012-2716
Cross-site request forgery (CSRF) vulnerability in the Comment Moderation module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that publish comments. Una vulnerabilidad de falsificación de peticiones en sitios cruzados(CSRF) en el módulo 'Comment Moderation' v6.x-1.x antes de v6.x-1.1 para Drupal permite a atacantes remotos secuestrar la autentificación de los administradores en las solicitudes que publican comentarios. • http://drupal.org/node/1538768 http://drupal.org/node/1608822 http://drupalcode.org/project/comment_moderation.git/commitdiff/f18c3de http://osvdb.org/82434 http://secunia.com/advisories/49326 http://www.securityfocus.com/bid/53738 https://exchange.xforce.ibmcloud.com/vulnerabilities/75998 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.0EPSS: 0%CPEs: 79EXPL: 2CVE-2012-2922
https://notcve.org/view.php?id=CVE-2012-2922
The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message. La función request_path en includes/bootstrap.inc en Drupal v7.14 y anteriores, permite a atacantes remotos obtener información sensible a través del parámetro q[] sobre index.php, lo que revela el path de instalación en un mensaje de error. • http://archives.neohapsis.com/archives/bugtraq/2012-05/0052.html http://archives.neohapsis.com/archives/bugtraq/2012-05/0053.html http://archives.neohapsis.com/archives/bugtraq/2012-05/0055.html http://osvdb.org/81817 http://secunia.com/advisories/49131 http://www.mandriva.com/security/advisories?name=MDVSA-2013:074 http://www.openwall.com/lists/oss-security/2012/08/02/8 http://www.securityfocus.com/bid/53454 https://exchange.xforce.ibmcloud.com/vulnerabilities/75531 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2012-2339
https://notcve.org/view.php?id=CVE-2012-2339
Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "taxonomy information." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo Glosario ("Glossary") 6.x-1.x anteriores a la 6.x-1.8 de Drupal. Permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través de vectores sin especificar relacionados con información de taxonomías. • http://drupal.org/node/1568156 http://drupal.org/node/1569482 http://drupalcode.org/project/glossary.git/commitdiff/c6cc3ac http://secunia.com/advisories/49074 http://www.openwall.com/lists/oss-security/2012/05/10/6 http://www.openwall.com/lists/oss-security/2012/05/11/2 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.openwall.com/lists/oss-security/2012/06/15/6 http://www.securityfocus.com/bid/53440 https://exchange.xforce.ibmcloud. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 3EXPL: 0CVE-2012-2340
https://notcve.org/view.php?id=CVE-2012-2340
The Contact Forms module 7.x-1.x before 7.x-1.2 for Drupal does not specify sufficiently restrictive permissions, which allows remote authenticated users with the "access the site-wide contact form" permission to modify the module settings via unspecified vectors. El módulo Contact Forms v7.x-1.x y anteriores a v7.x-1.2 para Drupal no especifica permisos suficientemente restrictivos, lo que permite a usuarios remotos autenticados con "acceso al formulario de contacto" permiso para modificar los ajustes del módulo a través de no vectores no especificados. • http://drupal.org/node/1569352 http://drupal.org/node/1569508 http://drupalcode.org/project/contact_forms.git/commitdiff/d11ce2b http://secunia.com/advisories/49070 http://www.openwall.com/lists/oss-security/2012/05/10/6 http://www.openwall.com/lists/oss-security/2012/05/11/2 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.openwall.com/lists/oss-security/2012/06/15/6 http://www.securityfocus.com/bid/53441 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 2.6EPSS: 0%CPEs: 4EXPL: 0CVE-2012-2907
https://notcve.org/view.php?id=CVE-2012-2907
Cross-site scripting (XSS) vulnerability in the aberdeen_breadcrumb function in template.php in the Aberdeen theme 6.x-1.x before 6.x-1.11 for Drupal, when set to append the content title to the breadcrumb, allows remote attackers to inject arbitrary web script or HTML via the content title in a breadcrumb. Una vulnerabilidad de ejecución de comandos en sitios cruzados(XSS) en la función aberdeen_breadcrumb en el fichero template.php del tema 'Aberdeen' v6.x-1.x antes de v6.x-1.11 para Drupal, cuando se configura para que se pueda añadir los títulos de los contenidos en la ruta de navegación, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de los títulos de contenido en una ruta de navegación. • http://drupal.org/node/1585878 http://drupal.org/node/1585890 http://drupalcode.org/project/aberdeen.git/commitdiff/1994e8e http://secunia.com/advisories/49150 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.openwall.com/lists/oss-security/2012/06/27/10 http://www.securityfocus.com/bid/53581 https://exchange.xforce.ibmcloud.com/vulnerabilities/75712 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •