CVSS: 3.5EPSS: 0%CPEs: 8EXPL: 0CVE-2012-4500
https://notcve.org/view.php?id=CVE-2012-4500
The Announcements module 6.x-1.x before 6.x-1.5 for Drupal allows remote authenticated users with the "access announcements" permission to bypass node access restrictions and possibly have other unspecified impact. El módulo Announcements v6.x-1.x antes de v6.x-1.5 para Drupal permite a usuarios autenticados remotamente con permisos "access announcements" evitar restricciones y posiblemente tener otro impacto no especificado. • http://drupal.org/node/1761038 http://drupal.org/node/1762480 http://www.openwall.com/lists/oss-security/2012/10/04/6 http://www.openwall.com/lists/oss-security/2012/10/07/1 http://www.securityfocus.com/bid/55283 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 2CVE-2012-2298
https://notcve.org/view.php?id=CVE-2012-2298
Multiple cross-site scripting (XSS) vulnerabilities in the RealName module 6.x-1.x before 6.x-1.5 for Drupal allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) "user names in page titles" and (2) "autocomplete callbacks." Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en el módulo realname v6.x-1.x antes de v6.x-1.5 para Drupal permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores relacionados con (1) los nombres de usuario "en la página títulos" y (2) "las llamadas a autocompletar". • http://drupal.org/node/1547352 http://drupal.org/node/1547660 http://drupalcode.org/project/realname.git/commitdiff/41786d0 http://drupalcode.org/project/realname.git/commitdiff/b920794 http://secunia.com/advisories/48936 http://www.openwall.com/lists/oss-security/2012/05/03/1 http://www.openwall.com/lists/oss-security/2012/05/03/2 http://www.securityfocus.com/bid/53250 https://exchange.xforce.ibmcloud.com/vulnerabilities/75181 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 1CVE-2012-2302
https://notcve.org/view.php?id=CVE-2012-2302
Site Documentation (Sitedoc) module for Drupal 6.x-1.x before 6.x-1.4 does not properly check the save location when archiving, which allows remote attackers to obtain sensitive information via unspecified vectors. El módulo para Drupal Site Documentation (Sitedoc) no comprueba correctamente la ubicación de almacenamiento al comprimir, lo que permite a atacantes remotos obtener información sensible a través de vectores no especificados. • http://drupal.org/node/1546224 http://drupal.org/node/1547686 http://drupalcode.org/project/sitedoc.git/commitdiff/521721c http://www.openwall.com/lists/oss-security/2012/05/03/1 http://www.openwall.com/lists/oss-security/2012/05/03/2 http://www.osvdb.org/81555 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 2.1EPSS: 0%CPEs: 8EXPL: 1CVE-2012-2711
https://notcve.org/view.php?id=CVE-2012-2711
Multiple cross-site scripting (XSS) vulnerabilities in the Taxonomy List module 6.x-1.x before 6.x-1.4 for Drupal allow remote authenticated users with create or edit taxonomy terms permissions to inject arbitrary web script or HTML via vectors related to taxonomy information. vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Taxonomy List v6.x-1.x anterior a v6.x-1.4 para Drupal, permite a usuarios remotos autenticados, con permisos para crear o editar términos de la taxonomía a inyectar secuencias de comandos web o HTML a través de vectores que implican información de la taxonomía. • http://drupal.org/node/1595396 http://drupal.org/node/1597262 http://drupalcode.org/project/taxonomy_list.git/commitdiff/7dd21a0 http://secunia.com/advisories/49238 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.osvdb.org/82164 http://www.securityfocus.com/bid/53671 https://exchange.xforce.ibmcloud.com/vulnerabilities/75867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 14EXPL: 0CVE-2012-2339
https://notcve.org/view.php?id=CVE-2012-2339
Cross-site scripting (XSS) vulnerability in the Glossary module 6.x-1.x before 6.x-1.8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "taxonomy information." Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo Glosario ("Glossary") 6.x-1.x anteriores a la 6.x-1.8 de Drupal. Permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través de vectores sin especificar relacionados con información de taxonomías. • http://drupal.org/node/1568156 http://drupal.org/node/1569482 http://drupalcode.org/project/glossary.git/commitdiff/c6cc3ac http://secunia.com/advisories/49074 http://www.openwall.com/lists/oss-security/2012/05/10/6 http://www.openwall.com/lists/oss-security/2012/05/11/2 http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.openwall.com/lists/oss-security/2012/06/15/6 http://www.securityfocus.com/bid/53440 https://exchange.xforce.ibmcloud. • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •