Search CVE reports
71 – 80 of 128 results
CVE-2016-3165
Unknown priorityThe Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has...
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | — | — | — | — | Not in release |
| drupal7 | — | — | — | — | Not affected |
CVE-2016-3164
Medium priorityDrupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2016-3163
Medium priorityThe XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2016-3162
Medium priorityThe File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging...
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2015-6665
Medium prioritySome fixes available 1 of 8
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a...
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2015-6661
Medium prioritySome fixes available 1 of 8
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2015-6660
Medium prioritySome fixes available 1 of 8
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to...
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2015-6659
Medium prioritySome fixes available 1 of 8
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2015-6658
Medium prioritySome fixes available 1 of 8
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |
CVE-2015-3234
Medium prioritySome fixes available 2 of 5
The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and...
2 affected packages
drupal6, drupal7
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| drupal6 | Not in release | Not in release | Not in release | Not in release | Not in release |
| drupal7 | Not in release | Not in release | Not in release | Not in release | Not affected |