Drupal

Drupal

266 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.9

CVE-2014-5020

  • EPSS 0.11%
  • Veröffentlicht 22.07.2014 14:55:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file ...

2.1

CVE-2014-5021

  • EPSS 0.23%
  • Veröffentlicht 22.07.2014 14:55:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group lab...

4.3

CVE-2014-5022

  • EPSS 0.26%
  • Veröffentlicht 22.07.2014 14:55:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.

5

CVE-2014-2983

  • EPSS 0.43%
  • Veröffentlicht 23.04.2014 15:55:05
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vect...

4.3

CVE-2014-1607

  • EPSS 0.36%
  • Veröffentlicht 26.01.2014 20:55:06
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Te...

7.5

CVE-2014-1475

  • EPSS 0.84%
  • Veröffentlicht 24.01.2014 18:55:05
  • Zuletzt bearbeitet 11.04.2025 00:51:21

The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.

4

CVE-2014-1476

  • EPSS 0.36%
  • Veröffentlicht 24.01.2014 18:55:05
  • Zuletzt bearbeitet 11.04.2025 00:51:21

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page.

2.6

CVE-2013-0244

  • EPSS 0.44%
  • Veröffentlicht 19.01.2014 17:16:30
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involv...

2.1

CVE-2013-6387

  • EPSS 0.21%
  • Veröffentlicht 24.12.2013 20:55:04
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field.

4.3

CVE-2013-6388

  • EPSS 0.3%
  • Veröffentlicht 24.12.2013 20:55:04
  • Zuletzt bearbeitet 11.04.2025 00:51:21

Cross-site scripting (XSS) vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS.