Vulnerabilities (CVE)

Filtered by vendor Drupal Subscribe
Filtered by product Drupal
Total 709 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2015-7880 1 Drupal 1 Drupal 2024-11-21 4.0 MEDIUM 4.3 MEDIUM
The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other accounts" permission and knowledge of usernames.
CVE-2015-6665 3 Chaos Tool Suite Project, Drupal, Fedoraproject 3 Ctools, Drupal, Fedora 2024-11-21 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag.
CVE-2015-6661 1 Drupal 1 Drupal 2024-11-21 5.0 MEDIUM N/A
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
CVE-2015-6660 1 Drupal 1 Drupal 2024-11-21 6.8 MEDIUM N/A
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
CVE-2015-6659 1 Drupal 1 Drupal 2024-11-21 7.5 HIGH N/A
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
CVE-2015-6658 1 Drupal 1 Drupal 2024-11-21 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
CVE-2015-3234 2 Debian, Drupal 2 Debian Linux, Drupal 2024-11-21 4.3 MEDIUM N/A
The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
CVE-2015-3233 1 Drupal 1 Drupal 2024-11-21 5.8 MEDIUM N/A
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2015-3232 2 Debian, Drupal 2 Debian Linux, Drupal 2024-11-21 5.8 MEDIUM N/A
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
CVE-2015-3231 2 Debian, Drupal 2 Debian Linux, Drupal 2024-11-21 4.0 MEDIUM N/A
The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache.
CVE-2015-2750 2 Debian, Drupal 2 Debian Linux, Drupal 2024-11-21 5.8 MEDIUM 6.1 MEDIUM
Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.
CVE-2015-2749 2 Debian, Drupal 2 Debian Linux, Drupal 2024-11-21 5.8 MEDIUM 6.1 MEDIUM
Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
CVE-2015-2559 2 Debian, Drupal 2 Debian Linux, Drupal 2024-11-21 3.5 LOW N/A
Drupal 6.x before 6.35 and 7.x before 7.35 allows remote authenticated users to reset the password of other accounts by leveraging an account with the same password hash as another account and a crafted password reset URL.
CVE-2014-9016 3 Debian, Drupal, Secure Password Hashes Project 3 Debian Linux, Drupal, Secure Passwords Hashes 2024-11-21 5.0 MEDIUM N/A
The password hashing API in Drupal 7.x before 7.34 and the Secure Password Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote attackers to cause a denial of service (CPU and memory consumption) via a crafted request.
CVE-2014-9015 2 Debian, Drupal 2 Debian Linux, Drupal 2024-11-21 6.8 MEDIUM N/A
Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to hijack sessions via a crafted request, as demonstrated by a crafted request to a server that supports both HTTP and HTTPS sessions.
CVE-2014-5267 1 Drupal 1 Drupal 2024-11-21 6.8 MEDIUM N/A
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
CVE-2014-5266 3 Debian, Drupal, Wordpress 3 Debian Linux, Drupal, Wordpress 2024-11-21 5.0 MEDIUM N/A
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
CVE-2014-5265 3 Debian, Drupal, Wordpress 3 Debian Linux, Drupal, Wordpress 2024-11-21 5.0 MEDIUM N/A
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVE-2014-5022 1 Drupal 1 Drupal 2024-11-21 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.
CVE-2014-5021 1 Drupal 1 Drupal 2024-11-21 2.1 LOW N/A
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.