Drupal

Drupal

284 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2006-2260

  • EPSS 1.21%
  • Veröffentlicht 09.05.2006 10:02:00
  • Zuletzt bearbeitet 16.06.2026 22:24:39

Cross-site scripting (XSS) vulnerability in the project module (project.module) in Drupal 4.5 and 4.6 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

5

CVE-2006-1225

  • EPSS 1.97%
  • Veröffentlicht 14.03.2006 19:06:00
  • Zuletzt bearbeitet 16.06.2026 22:22:15

CRLF injection vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject headers of outgoing e-mail messages and use Drupal as a spam proxy.

4.3

CVE-2006-1226

  • EPSS 1.71%
  • Veröffentlicht 14.03.2006 19:06:00
  • Zuletzt bearbeitet 16.06.2026 22:22:15

Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

4.6

CVE-2006-1227

  • EPSS 0.87%
  • Veröffentlicht 14.03.2006 19:06:00
  • Zuletzt bearbeitet 16.06.2026 22:22:15

Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8, when menu.module is used to create a menu item, does not implement access control for the page that is referenced, which might allow remote attackers to access administrator pages.

5.1

CVE-2006-1228

  • EPSS 1.81%
  • Veröffentlicht 14.03.2006 19:06:00
  • Zuletzt bearbeitet 16.06.2026 22:22:15

Session fixation vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to gain privileges by tricking a user to click on a URL that fixes the session identifier.

4.3

CVE-2006-0070

Exploit
  • EPSS 1.06%
  • Veröffentlicht 04.01.2006 00:03:00
  • Zuletzt bearbeitet 16.06.2026 22:19:50

Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function. NOTE: a followup by the vendor suggests that the ...

4.3

CVE-2005-3973

  • EPSS 1.44%
  • Veröffentlicht 03.12.2005 19:03:00
  • Zuletzt bearbeitet 16.06.2026 22:17:59

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value paramet...

6.4

CVE-2005-3974

  • EPSS 1.69%
  • Veröffentlicht 03.12.2005 19:03:00
  • Zuletzt bearbeitet 16.06.2026 22:17:59

Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3, when running on PHP5, does not correctly enforce user privileges, which allows remote attackers to bypass the "access user profiles" permission.

4

CVE-2005-3975

  • EPSS 4.82%
  • Veröffentlicht 03.12.2005 19:03:00
  • Zuletzt bearbeitet 16.06.2026 22:17:59

Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be execu...

7.5

CVE-2005-1921

  • EPSS 79.07%
  • Veröffentlicht 05.07.2005 04:00:00
  • Zuletzt bearbeitet 16.06.2026 22:13:55

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) Mail...