Drupal

Drupal

266 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.8

CVE-2015-3232

  • EPSS 0.44%
  • Published 22.06.2015 19:59:00
  • Last modified 12.04.2025 10:46:40

Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.

3.5

CVE-2015-2559

  • EPSS 0.45%
  • Published 25.03.2015 14:59:05
  • Last modified 12.04.2025 10:46:40

Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.

6.1

CVE-2010-5312

Exploit
  • EPSS 3.85%
  • Published 24.11.2014 16:59:00
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.

5

CVE-2014-9016

  • EPSS 79.79%
  • Published 24.11.2014 15:59:17
  • Last modified 12.04.2025 10:46:40

The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.

6.8

CVE-2014-9015

  • EPSS 1.91%
  • Published 24.11.2014 15:59:16
  • Last modified 12.04.2025 10:46:40

Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.

7.5

CVE-2014-3704

Exploit
  • EPSS 94.37%
  • Published 16.10.2014 00:55:06
  • Last modified 12.04.2025 10:46:40

The expandArguments function in the database abstraction API in Drupal core 7.x before 7.32 does not properly construct prepared statements, which allows remote attackers to conduct SQL injection attacks via an array containing crafted keys.

6.8

CVE-2014-5267

  • EPSS 0.58%
  • Published 30.09.2014 14:55:08
  • Last modified 12.04.2025 10:46:40

modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.

5

CVE-2014-5265

  • EPSS 7.02%
  • Published 18.08.2014 11:15:27
  • Last modified 12.04.2025 10:46:40

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of...

5

CVE-2014-5266

  • EPSS 76.31%
  • Published 18.08.2014 11:15:27
  • Last modified 12.04.2025 10:46:40

The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption...

5

CVE-2014-5019

  • EPSS 0.38%
  • Published 22.07.2014 14:55:10
  • Last modified 12.04.2025 10:46:40

The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.