Drupal
by Drupal
Source repositories
CVEs (203)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2010-2471 | 0.00 | — | 0.01 | Nov 6, 2019 | Drupal versions 5.x and 6.x has open redirection | |||
| CVE-2017-6925 | 0.00 | — | 0.03 | Jan 15, 2019 | In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different… | |||
| CVE-2015-6665 | 0.00 | — | 0.03 | Aug 24, 2015 | Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to… | |||
| CVE-2015-6661 | 0.00 | — | 0.03 | Aug 24, 2015 | Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. | |||
| CVE-2015-6660 | 0.00 | — | 0.01 | Aug 24, 2015 | The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks." | |||
| CVE-2015-6659 | 0.00 | — | 0.05 | Aug 24, 2015 | SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment. | |||
| CVE-2015-6658 | 0.00 | — | 0.02 | Aug 24, 2015 | Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. | |||
| CVE-2015-3234 | 0.00 | — | 0.02 | Jun 22, 2015 | The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers. | |||
| CVE-2015-3233 | 0.00 | — | 0.03 | Jun 22, 2015 | Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | |||
| CVE-2015-3232 | 0.00 | — | 0.02 | Jun 22, 2015 | Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter. | |||
| CVE-2015-3231 | 0.00 | — | 0.02 | Jun 22, 2015 | The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache. | |||
| CVE-2015-2559 | 0.00 | — | 0.02 | Mar 25, 2015 | Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL. | |||
| CVE-2014-9015 | 0.00 | — | 0.02 | Nov 24, 2014 | Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions. | |||
| CVE-2014-5267 | 0.00 | — | 0.04 | Sep 30, 2014 | modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document. | |||
| CVE-2014-5266 | 0.00 | — | 0.24 | Aug 18, 2014 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a… | |||
| CVE-2014-5265 | 0.00 | — | 0.03 | Aug 18, 2014 | The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU… | |||
| CVE-2014-5022 | 0.00 | — | 0.01 | Jul 22, 2014 | Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field. | |||
| CVE-2014-5021 | 0.00 | — | 0.01 | Jul 22, 2014 | Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label. | |||
| CVE-2014-5020 | 0.00 | — | 0.01 | Jul 22, 2014 | The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field. | |||
| CVE-2014-5019 | 0.00 | — | 0.03 | Jul 22, 2014 | The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use. |
- CVE-2010-2471Nov 6, 2019risk 0.00cvss —epss 0.01
Drupal versions 5.x and 6.x has open redirection
- CVE-2017-6925Jan 15, 2019risk 0.00cvss —epss 0.03
In versions of Drupal 8 core prior to 8.3.7; There is a vulnerability in the entity access system that could allow unwanted access to view, create, update, or delete entities. This only affects entities that do not use or do not have UUIDs, and entities that have different…
- CVE-2015-6665Aug 24, 2015risk 0.00cvss —epss 0.03
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to…
- CVE-2015-6661Aug 24, 2015risk 0.00cvss —epss 0.03
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
- CVE-2015-6660Aug 24, 2015risk 0.00cvss —epss 0.01
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
- CVE-2015-6659Aug 24, 2015risk 0.00cvss —epss 0.05
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
- CVE-2015-6658Aug 24, 2015risk 0.00cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
- CVE-2015-3234Jun 22, 2015risk 0.00cvss —epss 0.02
The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
- CVE-2015-3233Jun 22, 2015risk 0.00cvss —epss 0.03
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
- CVE-2015-3232Jun 22, 2015risk 0.00cvss —epss 0.02
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
- CVE-2015-3231Jun 22, 2015risk 0.00cvss —epss 0.02
The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache.
- CVE-2015-2559Mar 25, 2015risk 0.00cvss —epss 0.02
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
- CVE-2014-9015Nov 24, 2014risk 0.00cvss —epss 0.02
Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.
- CVE-2014-5267Sep 30, 2014risk 0.00cvss —epss 0.04
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
- CVE-2014-5266Aug 18, 2014risk 0.00cvss —epss 0.24
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a…
- CVE-2014-5265Aug 18, 2014risk 0.00cvss —epss 0.03
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU…
- CVE-2014-5022Jul 22, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.
- CVE-2014-5021Jul 22, 2014risk 0.00cvss —epss 0.01
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.
- CVE-2014-5020Jul 22, 2014risk 0.00cvss —epss 0.01
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.
- CVE-2014-5019Jul 22, 2014risk 0.00cvss —epss 0.03
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.
Page 4 of 11