Drupal Core file_create_filename Stored Cross-Site Scripting (CVE-2019-6341)

A stored cross-site scripting vulnerability exists in the File module of Drupal Core. The vulnerability is due to improper handling of the filename parameter provided for file uploads to the File module. Successful exploitation could result in the execution of arbitrary script code...

CVE-2012-2079

A cross-site request forgery CSRF vulnerability in the Activity module 6.x-1.x for Drupal...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in the Activity module 6.x-1.x for Drupal...

CVE-2012-1637

Cross-site scripting vulnerability XSS in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal...

CVE-2012-2078

Cross-site scripting XSS vulnerability in the Activity module 6.x-1.x for Drupal...

Cross site scripting

Cross-site scripting XSS vulnerability in the Activity module 6.x-1.x for Drupal...

Cross site scripting

Cross-site scripting vulnerability XSS in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal...

CVE-2012-2079

A cross-site request forgery CSRF vulnerability in the Activity module 6.x-1.x for Drupal...

CVE-2012-2079

The CVE-2012-2079 CSRF vulnerability affects the Drupal Activity module (6.x-1.x). The 6.x-1.x branch does not filter output correctly and does not confirm user intent when removing an activity, enabling unauthorized state-changing requests to the server. Impact details in public advisories descr...

CVE-2012-2078

Cross-site scripting XSS vulnerability in the Activity module 6.x-1.x for Drupal...

CVE-2012-2078

Activity module 6.x-1.x (Drupal) is affected by a cross-site scripting (XSS) vulnerability due to output not being properly filtered, and an associated issue where removing an activity could trigger a cross-site request forgery (CSRF). Exploitation requires a user with the permissions to access a...

CVE-2012-1637

Cross-site scripting vulnerability XSS in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal...

CVE-2012-1637

The CVE-2012-1637 vulnerability affects the Drupal Quick Tabs contributed module, not Drupal core. It is a Cross-Site Scripting (XSS) issue caused by insufficient filtering of user-supplied text. Affected versions are Quicktabs 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7....

Unspecified Vulnerability in Drupal

Drupal is an open source content management system developed by the Drupal community using the PHP language. A security vulnerability exists in version 7.x prior to Drupal 7.5, which can be exploited by attackers to download files attached to comments...

CVE-2011-2726

An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied...

Design/Logic Flaw

An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied...

CVE-2011-2726

An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied...

CVE-2011-2726

Removed by vendor...

CVE-2011-2726

An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied...

CVE-2011-2726

Summary (CVE-2011-2726) : Drupal 7.x before 7.5 is affected by an access-bypass vulnerability related to file attachments in comments. If a site enables File upload fields on any entity or points fields to the private file directory, non-privileged users can download a file attached to a comment ...