Drupal Archives - CVE Vulnerability

CVE-2008-7151

Sun, 26 Feb 2023 09:11:53 +0000

Cross-site request forgery (CSRF) vulnerability in Live 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to hijack the authentication of unspecified privileged users for requests that can be leveraged to execute arbitrary PHP code.

The post CVE-2008-7151 appeared first on CVE Vulnerability.

CVE-2008-7150

Sun, 26 Feb 2023 09:11:53 +0000

Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x before 5.x-0.1, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a taxonomy term, which is not properly handled by refine_by_taxo when displaying tags.

The post CVE-2008-7150 appeared first on CVE Vulnerability.

CVE-2008-6972

Sun, 26 Feb 2023 09:11:48 +0000

Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with “administer content” permissions to inject arbitrary web script or HTML via the (1) “field label,” (2) “help text,” or (3) “allowed values” settings.

The post CVE-2008-6972 appeared first on CVE Vulnerability.

CVE-2008-6910

Sun, 26 Feb 2023 09:11:46 +0000

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not use timeouts for signed requests, which allows remote attackers to impersonate other users and gain privileges via a replay attack that sends the same request.

The post CVE-2008-6910 appeared first on CVE Vulnerability.

CVE-2008-6909

Sun, 26 Feb 2023 09:11:46 +0000

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges.

The post CVE-2008-6909 appeared first on CVE Vulnerability.

CVE-2008-6908

Sun, 26 Feb 2023 09:11:46 +0000

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, uses an insecure hash when signing requests, which allows remote attackers to impersonate other users and gain privileges.

The post CVE-2008-6908 appeared first on CVE Vulnerability.

CVE-2008-6836

Sun, 26 Feb 2023 09:11:44 +0000

Cross-site request forgery (CSRF) vulnerability in OpenID 5.x before 5x.-1.2, a module for Drupal, allows remote attackers to hijack the authentication of unspecified victims to delete OpenID identities via unknown vectors.

The post CVE-2008-6836 appeared first on CVE Vulnerability.

CVE-2008-6835

Sun, 26 Feb 2023 09:11:44 +0000

Cross-site scripting (XSS) vulnerability in OpenID 5.x before 5.x-1.2, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The post CVE-2008-6835 appeared first on CVE Vulnerability.

CVE-2008-6384

Sun, 26 Feb 2023 09:11:29 +0000

Multiple cross-site request forgery (CSRF) vulnerabilities in Comment Mail 5.x before 5.x-1.1, a module for Drupal, allow remote attackers to hijack the authentication of administrators.

The post CVE-2008-6384 appeared first on CVE Vulnerability.

CVE-2008-6229

Sun, 26 Feb 2023 09:11:25 +0000

Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit (CCK) 5.x before 5.x-1.10 and 6.x before 6.x-2.0, a module for Drupal, allows remote authenticated users with “administer content” permissions to inject arbitrary web script or HTML via (1) field labels and (2) content-type names.

The post CVE-2008-6229 appeared first on CVE Vulnerability.