Vulnerabilities (CVE)

Filtered by vendor Drupal Subscribe
Filtered by product Drupal
Total 709 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2015-6658 1 Drupal 1 Drupal 2024-02-28 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
CVE-2016-3169 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 6.8 MEDIUM 8.1 HIGH
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
CVE-2016-5385 8 Debian, Drupal, Fedoraproject and 5 more 14 Debian Linux, Drupal, Fedora and 11 more 2024-02-28 5.1 MEDIUM 8.1 HIGH
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
CVE-2015-8095 2 Drupal, Monster Menus Module Project 2 Drupal, Monster Menus 2024-02-28 5.0 MEDIUM N/A
The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.
CVE-2016-6212 1 Drupal 1 Drupal 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.
CVE-2016-7570 1 Drupal 1 Drupal 2024-02-28 4.0 MEDIUM 4.3 MEDIUM
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
CVE-2016-3164 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 5.8 MEDIUM 7.4 HIGH
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
CVE-2015-6659 1 Drupal 1 Drupal 2024-02-28 7.5 HIGH N/A
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
CVE-2015-3232 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 5.8 MEDIUM N/A
Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter.
CVE-2016-3162 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 6.5 MEDIUM 8.1 HIGH
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
CVE-2015-3234 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 4.3 MEDIUM N/A
The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
CVE-2016-3170 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.
CVE-2016-3166 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 4.3 MEDIUM 5.9 MEDIUM
CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
CVE-2016-3163 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 5.0 MEDIUM 7.5 HIGH
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
CVE-2016-3167 3 Debian, Drupal, Php 3 Debian Linux, Drupal, Php 2024-02-28 6.4 MEDIUM 7.4 HIGH
Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.
CVE-2015-6661 1 Drupal 1 Drupal 2024-02-28 5.0 MEDIUM N/A
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
CVE-2016-7571 1 Drupal 1 Drupal 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.
CVE-2015-6660 1 Drupal 1 Drupal 2024-02-28 6.8 MEDIUM N/A
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
CVE-2015-3231 2 Debian, Drupal 2 Debian Linux, Drupal 2024-02-28 4.0 MEDIUM N/A
The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache.
CVE-2016-3165 1 Drupal 1 Drupal 2024-02-28 5.0 MEDIUM 7.5 HIGH
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.