CVE-2008-3220

Cross-site request forgery CSRF vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of "translated strings."...

CVE-2008-3221

Cross-site request forgery CSRF vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities...

CVE-2008-3223

SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."...

CVE-2008-3218

CVE-2008-3218 affects Drupal 6.x before 6.3, with XSS via free-tagging taxonomy terms on node previews and unspecified OpenID values. Remote attackers can inject arbitrary script/HTML. Connected advisories indicate remediation by upgrading to Drupal 6.4 (and related updates); no exploitation deta...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in E-Publish 5.x before 5.x-1.1 and 6.x before 6.x-1.0 beta1, a Drupal module, allows remote attackers to perform unauthorized actions as other users via unspecified vectors...

Design/Logic Flaw

The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to 1 edit the profile pages of arbitrary users, and obtain sensitive information from 2 tracker and 3 blog pages, related to a missing check for the "access content" permission; and 4 allows remote...

CVE-2008-1729

The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to 1 edit the profile pages of arbitrary users, and obtain sensitive information from 2 tracker and 3 blog pages, related to a missing check for the "access content" permission; and 4 allows remote...