CVE-2008-6170

Cross-site scripting XSS vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title...

SA-CORE-2009-001 Drupal core - Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal. Access Bypass The Content Translation module for Drupal 6.x enables users to make a translation of an existing item of content a node. In that process the existing node's content is copied into the new node's submission form. The...

SA-2008-071 - User Karma - Multiple vulnerabilities

The User Karma module displays and manages karma points of users. How karma points are calculated is defined by other modules which hook into the User Karma module. Unfortunately the User Karma module allows administrators to enter a list of content types and voting API values which are then used...

SA-2008-062 - SIOC - access bypass

The SIOC Semantically-Interconnected Online Communities project is an open specification for describing communities using online discussion forums or blogs, the module allows Drupal sites to attach metadata to users, posts, comments etc. in line with this specification. The module doesn't impleme...

SA-2008-055 - Stock - Cross site scripting

The stock module provides the ability to query price quotes and trading volumes from various stock markets. An oversight in the menu permissions code allows any user to change the text of the heading at the top of the stock quotes page. As this text is not escaped, it is safe only for an...

SA-2008-051 - Mailsave - Cross site scripting

Mailsave is a module that is designed to interact with mailhandler. It will detach files that are emailed to the site and save them with the node. The module trusts the mimetype that is send with the file enabling malicious users with the ability to upload files to execute cross site scripting...

CVE-2008-3742

Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for 1 cached forms and 2 forms with AHAH elements...

Cross site scripting

Cross-site scripting XSS vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Code injection

The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors...

CVE-2008-3745

The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors...

CVE-2008-3744

Multiple cross-site request forgery CSRF vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that 1 add or 2 delete user access rules...

CVE-2008-3743

Multiple cross-site request forgery CSRF vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions via unknown vectors, related to improper token validation for 1 cached forms and 2 forms with AHAH elements...

CVE-2008-3743

CVE-2008-3743 affects Drupal 6.x before 6.4. The vulnerability is a CSRF issue caused by improper token validation for cached forms and forms with AHAH elements, enabling remote attackers to perform unspecified actions. The MiracleLinux advisories reference this CVE and indicate remediation by up...

CVE-2008-3745

The CVE-2008-3745 vulnerability affects Drupal 6.x prior to 6.4, in the Upload module. The issue allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via unspecified vectors, indicating privilege/asset exposure within the Drupal content workflow. Th...

CVE-2008-3744

Multiple cross-site request forgery CSRF vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authentication of administrators for requests that 1 add or 2 delete user access rules...

CVE-2008-3742

Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, which is not validated...

SA-2008-047 - Drupal core - Multiple vulnerabilities

Multiple vulnerabilities and weaknesses were discovered in Drupal. Cross site scripting A bug in the output filter employed by Drupal makes it possible for malicious users to insert script code into pages cross site scripting or XSS. A bug in the private filesystem trusts the MIME type sent by th...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 free tagging taxonomy terms, which are not properly handled on node preview pages, and 2 unspecified OpenID values...

CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...