CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2008-3745
https://notcve.org/view.php?id=CVE-2008-3745
The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors. El módulo Upload en Drupal 6.x anterior a 6.4, permite a usuarios autenticados en remoto editar nodos, eliminar ficheros y descargar adjuntos no autorizados a través de vectores no especificados. • http://drupal.org/node/295053 http://secunia.com/advisories/31825 http://www.securityfocus.com/bid/30689 http://www.vupen.com/english/advisories/2008/2392 https://bugzilla.redhat.com/show_bug.cgi?id=459108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44458 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.4EPSS: 2%CPEs: 2EXPL: 0CVE-2008-0569
https://notcve.org/view.php?id=CVE-2008-0569
The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows remote attackers to bypass upload validation, and upload arbitrary files and possibly execute arbitrary code, via unspecified vectors. El módulo Comment Upload 4.7.x antes de 4.7.x-0.1 y 5.x antes de 5.x-0.1 para Drupal no utiliza las funciones correctamente en el módulo upload (actualizar), que permite a atacantes remotos evitar la validación del upload y actualizar archivos arbitrarios y posiblemente ejecutar código arbitrario a través de vectores sin especificar. • http://drupal.org/node/216024 http://drupal.org/node/216035 http://drupal.org/node/216036 http://secunia.com/advisories/28729 http://www.securityfocus.com/bid/27544 http://www.vupen.com/english/advisories/2008/0374/references • CWE-264: Permissions, Privileges, and Access Controls •