VYPR
← Drupal

Vendor CVEs

Drupal

All CVEs

1,430 total · sorted by risk
  • CVE-2009-4514Dec 31, 2009
    Drupal
    OpenSocial Shindig-Integrator
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the OpenSocial Shindig-Integrator module 5.x and 6.x before 6.x-2.1, a module for Drupal, allows remote authenticated users, with "create application" privileges, to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4513Dec 31, 2009
    Drupal
    Workflow
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with "administer workflow" privileges, to inject arbitrary web script or HTML via the name of a (1)…

  • CVE-2009-4371Dec 21, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the…

  • CVE-2009-4370Dec 21, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly…

  • CVE-2009-4369Dec 21, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to…

  • CVE-2009-4207Dec 4, 2009
    Drupal
    webform
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.7 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a submission.

  • CVE-2009-4119Dec 1, 2009
    Drupal
    Feed Element Mapper
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Feed Element Mapper module 5.x before 5.x-1.3, 6.x before 6.x-1.3, and 6.x-2.0-alpha before 6.x-2.0-alpha4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4066Nov 24, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the "My Account" feature in PHPList Integration module 5 before 5.x-1.2 and 6 before 6.x-1.1 for Drupal allow remote attackers to hijack the authentication of arbitrary users via vectors related to (1) subscribing or…

  • CVE-2009-4065Nov 24, 2009
    Drupal
    Strongarm
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the settings page in the Strongarm module 6.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the value field when viewing overridden variables.

  • CVE-2009-4064Nov 24, 2009
    Drupal
    Gallery Assist
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Gallery Assist module 6.x before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via node titles.

  • CVE-2009-4063Nov 24, 2009
    Drupal
    Subgroups for Organic Groups (OG)
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Subgroups for Organic Groups (OG) module 5.x before 5.x-4.0 and 5.x before 5.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified node titles.

  • CVE-2009-4062Nov 24, 2009
    Drupal
    Printfriendly
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Printfriendly module 6.x before 6.x-1.6 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4061Nov 24, 2009
    Drupal
    Agreement
    risk 0.00cvss —epss 0.01

    Multiple cross-site scripting (XSS) vulnerabilities in the Agreement module 6.x before 6.x-1.2 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-4044Nov 20, 2009
    Drupal
    Web Services
    risk 0.00cvss —epss 0.01

    The Web Services module 6.x for Drupal does not perform the expected access control, which allows remote attackers to make unspecified use of an API via unknown vectors.

  • CVE-2009-4043Nov 20, 2009
    Drupal
    AddToAny
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the AddToAny module 5.x before 5.x-2.4 and 6.x before 6.x-2.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via a node title.

  • CVE-2009-4042Nov 20, 2009
    Drupal
    RootCandy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the RootCandy theme 6.x before 6.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via the URI.

  • CVE-2009-3922Nov 9, 2009
    Drupal
    User Protect
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in the User Protect module 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allow remote attackers to hijack the authentication of administrators for requests that (1) delete the editing protection of a…

  • CVE-2009-3920Nov 9, 2009
    Drupal
    NGP COO/CWP Integration (crmngp)
    risk 0.00cvss —epss 0.01

    An administration page in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal does not perform the expected access control, which allows remote attackers to read log information via unspecified vectors.

  • CVE-2009-3919Nov 9, 2009
    Drupal
    crmngp
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the NGP COO/CWP Integration (crmngp) module 6.x before 6.x-1.12 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified "user-supplied information."

  • CVE-2009-3917Nov 9, 2009
    Drupal
    S5 Presentation Player
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the S5 Presentation Player module 6.x-1.x before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an unspecified field that is copied to the HTML HEAD element.

  • CVE-2009-3916Nov 9, 2009
    Drupal
    Node Hierarchy
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Node Hierarchy module 5.x before 5.x-1.3 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a child node title.

  • CVE-2009-3915Nov 9, 2009
    Drupal
    Link Module
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "Separate title and URL" formatter in the Link module 5.x before 5.x-2.6 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the link title field.

  • CVE-2009-3914Nov 9, 2009
    Drupal
    Temporary Invitation
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Temporary Invitation module 5.x before 5.x-2.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the Name field in an invitation.

  • CVE-2009-3786Oct 26, 2009
    Drupal
    Organic Groups OG Vocabulary
    risk 0.00cvss —epss 0.02

    Cross-site scripting (XSS) vulnerability in Organic Groups (OG) Vocabulary 5.x before 5.x-1.1 and 6.x before 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the group title.

  • CVE-2009-3785Oct 26, 2009
    Drupal
    Simplenews Statistics
    risk 0.00cvss —epss 0.01

    Multiple cross-site request forgery (CSRF) vulnerabilities in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allow remote attackers to hijack the authentication of arbitrary users via unknown vectors.

  • CVE-2009-3784Oct 26, 2009
    Drupal
    Simplenews Statistics
    risk 0.00cvss —epss 0.01

    Open redirect vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

  • CVE-2009-3783Oct 26, 2009
    Drupal
    Simplenews Statistics
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Simplenews Statistics 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vector.

  • CVE-2009-3782Oct 26, 2009
    Drupal
    Userpoints
    risk 0.00cvss —epss 0.01

    Unspecified vulnerability in Userpoints 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users with "View own userpoints" permissions to read the userpoint data of arbitrary users via unknown attack vectors.

  • CVE-2009-3781Oct 26, 2009
    Drupal
    FileField
    risk 0.00cvss —epss 0.02

    The filefield_file_download function in FileField 6.x-3.1, a module for Drupal, does not properly check node-access permissions for Drupal core private files, which allows remote attackers to access unauthorized files via unspecified vectors.

  • CVE-2009-3780Oct 26, 2009
    Abuse
    Abuse
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Abuse 5.x before 5.x-2.1 and 6.x before 6.x-1.1-alpha1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3779Oct 26, 2009
    Drupal
    vCard
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in vCard 5.x before 5.x-1.4 and 6.x before 6.x-1.3, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the addition of the theme_vcard function to a theme and the use of…

  • CVE-2009-3778Oct 26, 2009
    Drupal
    Moodle Course List
    risk 0.00cvss —epss 0.01

    SQL injection vulnerability in Moodle Course List 6.x before 6.x-1.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

  • CVE-2009-3657Oct 9, 2009
    Drupal
    Shared Sign-On
    risk 0.00cvss —epss 0.01

    Session fixation vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack web sessions via unspecified vectors.

  • CVE-2009-3656Oct 9, 2009
    Drupal
    Shared Sign-On
    risk 0.00cvss —epss 0.01

    Cross-site request forgery (CSRF) vulnerability in Shared Sign-On 5.x and 6.x, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.

  • CVE-2009-3654Oct 9, 2009
    Drupal
    Boost
    risk 0.00cvss —epss 0.02

    Unspecified vulnerability in Boost before 6.x-1.03, a module for Drupal, allows remote attackers to create new webroot directories via unknown attack vectors.

  • CVE-2009-3653Oct 9, 2009
    Drupal
    XML Sitemap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with "administer site configuration" permission, to inject arbitrary web script or HTML via unspecified vectors, related to…

  • CVE-2009-3652Oct 9, 2009
    Drupal
    Organic Groups
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Organic Groups (OG) 5.x-7.x before 5.x-7.4, 5.x-8.x before 5.x-8.1, and 6.x-1.x before 6.x-1.4, a module for Drupal, allows remote authenticated users, with create or edit group nodes permissions, to inject arbitrary web script or HTML…

  • CVE-2009-3651Oct 9, 2009
    Drupal
    Browscap
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the "Monitor browsers' feature in Browscap before 5.x-1.1 and 6.x-1.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.

  • CVE-2009-3650Oct 9, 2009
    Drupal
    Dex
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Dex 5.x-1.0 and earlier and 6.x-1.0-rc1 and earlier, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

  • CVE-2009-3648Oct 9, 2009
    Drupal
    Service Links
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Service Links 6.x-1.0, a module for Drupal, allows remote authenticated users, with 'administer content types' permissions, to inject arbitrary web script or HTML via unspecified vectors when displaying content type names.

  • CVE-2009-3568Oct 6, 2009
    Drupal
    Comment RSS
    risk 0.00cvss —epss 0.01

    Comment RSS 5.x before 5.x-2.2 and 6.x before 6.x-2.2, a module for Drupal, does not properly enforce permissions when a link is added to the RSS feed, which allows remote attackers to obtain the node title and possibly other sensitive content by reading the feed.

  • CVE-2009-3488Sep 30, 2009
    Drupal
    Biblio
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the Bibliography (aka Biblio) module 6.x-1.6 for Drupal allows remote authenticated users, with certain content-creation privileges, to inject arbitrary web script or HTML via the Title field, probably a different vulnerability than…

  • CVE-2009-3479Sep 30, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x before 5.x-1.17 and 6.x before 6.x-1.6, a module for Drupal, allows remote attackers, with "create content displayed by the Bibliography module" permissions, to inject arbitrary web script or HTML via a title.

  • CVE-2009-3442Sep 28, 2009
    Drupal
    Meta tags (aka Nodewords)
    risk 0.00cvss —epss 0.01

    The Meta tags (aka Nodewords) module before 6.x-1.1 for Drupal does not properly follow permissions during assignment of node meta tags, which allows remote attackers to obtain sensitive information via unspecified vectors.

  • CVE-2009-3437Sep 28, 2009
    Drupal
    Markdown Preview
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the live preview feature in the Markdown Preview module 6.x for Drupal allows remote attackers to inject arbitrary web script or HTML via "Markdown input."

  • CVE-2009-3435Sep 28, 2009
    Drupal
    Devel
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the variable editor in the Devel module 5.x before 5.x-1.2 and 6.x before 6.x-1.18, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a variable name.

  • CVE-2009-3363Sep 24, 2009
    Drupal
    Bueditor
    risk 0.00cvss —epss 0.01

    Cross-site scripting (XSS) vulnerability in the BUEditor module 5.x before 5.x-1.2 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via input to the "plain textarea editor."

  • CVE-2009-3354Sep 24, 2009
    Drupal
    Rest API module
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in the Rest API module for Drupal have unknown impact and attack vectors.

  • CVE-2009-3352Sep 24, 2009
    Drupal
    Drupal
    risk 0.00cvss —epss 0.02

    Multiple unspecified vulnerabilities in the quota_by_role (Quota by role) module for Drupal have unknown impact and attack vectors.

  • CVE-2009-3350Sep 24, 2009
    Drupal
    Subdomain Manager
    risk 0.00cvss —epss 0.01

    Multiple unspecified vulnerabilities in the Subdomain Manager module for Drupal have unknown impact and attack vectors.

Page 24 of 29