17700 matches found
Sql injection
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment...
CVE-2015-6658
Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...
UBUNTU-CVE-2015-6659
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment...
CVE-2015-6661
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu...
UBUNTU-CVE-2015-6660
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."...
UBUNTU-CVE-2015-6665
Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...
CVE-2015-6660
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."...
CVE-2015-6665
CVE-2015-6665 affects Drupal 7.x up to version 7.39 and the Ctools module 6.x up to 6.x-1.14. The XSS flaw resides in the Ajax handler, allowing remote attackers to inject arbitrary scripts/HTML via a whitelisted HTML element (potentially the A tag). Remediation: upgrade to Drupal 7.39 and Ctools...
CVE-2015-6660
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."...
CVE-2015-6661
CVE-2015-6661 affects Drupal core: Drupal 6.x before 6.37 and 7.x before 7.39 are vulnerable. The issue allows remote attackers to obtain sensitive node titles by reading the site menu. The provided connected documents corroborate the vulnerability as part of Drupal core releases prior to the fix...
CVE-2015-6659
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment...
CVE-2015-6658
Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...
CVE-2015-6665
Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...
CVE-2015-6658
Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...
CVE-2015-6660
The CVE-2015-6660 issue affects Drupal 6.x up to 6.37 and Drupal 7.x up to 7.39, where the Form API does not properly validate the form token. This enables CSRF attacks that can upload files to another user’s account via vectors related to file upload value callbacks. Root cause: insufficient for...
CVE-2015-6658
CVE-2015-6658 affects Drupal autocomplete: XSS via crafted URLs in the Autocomplete system. Affected: Drupal 6.x before 6.37 and 7.x before 7.39 (related to uploading files). Root cause: input handling in autocomplete leads to script/HTML injection. Impact: remote attacker can execute arbitrary s...
CVE-2015-6659
Drupal 7.x contains a SQL injection vulnerability in the SQL comment filtering system of the Drupal Database API, exploitable before 7.39. Remote attackers can execute arbitrary SQL via an SQL comment. A patch/update to Drupal 7.39 fixes this vulnerability; apply or upgrade to 7.39 or later. If p...
CVE-2015-6660
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."...