Browse CVEs

HIGH 7.5 CVE-2008-4598 Unspecified vulnerability in Shindig-Integrator 5.x, a module for Drupal, has unspecified impact and remote attack vectors related to "numerous flaws… Shindig Integrator Mitigation only Fix from $1,9502008-10-17 HIGH 7.5 CVE-2008-4531 SQL injection vulnerability in Brilliant Gallery 5.x before 5.x-4.2, a module for Drupal, allows remote attackers to execute arbitrary SQL commands v… Brilliant Gallery after 5.x-4.1 Fix from $1,9502008-10-09 MEDIUM 5.0 CVE-2008-4153 The Talk module 5.x before 5.x-1.3 and 6.x before 6.x-1.5, a module for Drupal, does not perform access checks for a node before displaying comments,… Talk after 6.x-1.4 Fix from $1,6002008-09-24 HIGH 7.5 CVE-2008-4148 SQL injection vulnerability in the Mailhandler module 5.x before 5.x-1.4 and 6.x before 6.x-1.4, a module for Drupal, allows remote attackers to exec… Mailhandler after 6.x-1.3 Fix from $1,9502008-09-24 MEDIUM 5.0 CVE-2008-3661 Drupal, probably 5.10 and 6.4, does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http… Drupal Mitigation only Fix from $1,6002008-09-23 MEDIUM 6.5 CVE-2008-3742 Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execut… Drupal Mitigation only Fix from $1,6002008-08-27 MEDIUM 5.8 CVE-2008-3743 Multiple cross-site request forgery (CSRF) vulnerabilities in forms in Drupal 6.x before 6.4 allow remote attackers to perform unspecified actions vi… Drupal Mitigation only Fix from $1,6002008-08-27 MEDIUM 5.8 CVE-2008-3744 Multiple cross-site request forgery (CSRF) vulnerabilities in Drupal 5.x before 5.10 and 6.x before 6.4 allow remote attackers to hijack the authenti… Drupal Patch available Fix from $1,6002008-08-27 MEDIUM 5.5 CVE-2008-3745 The Upload module in Drupal 6.x before 6.4 allows remote authenticated users to edit nodes, delete files, and download unauthorized attachments via u… Drupal Patch available Fix from $1,6002008-08-27 HIGH 7.5 CVE-2008-3223 SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related … Drupal 6.3+ Fix from $1,9502008-07-18 MEDIUM 5.8 CVE-2008-3222 Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login ev… Drupal 5.9 / 6.3+ Fix from $1,6002008-07-18 MEDIUM 6.5 CVE-2008-3092 SQL injection vulnerability in the Taxonomy Autotagger module 5.x before 5.x-1.8 for Drupal allows remote authenticated users, with create or edit po… Taxonomy Autotagger Module Patch available Fix from $1,6002008-07-09 MEDIUM 6.5 CVE-2008-3096 The Outline Designer module 5.x before 5.x-1.4 for Drupal changes each content reader's authentication level to match that of the content author, whi… Outline Designer Module Patch available Fix from $1,6002008-07-09 HIGH 9.3 CVE-2008-3001 The Aggregation module 5.x before 5.x-4.4 for Drupal allows remote attackers to upload files with arbitrary extensions, and possibly execute arbitrar… Aggregation Module Patch available Fix from $1,9502008-07-03 HIGH 7.5 CVE-2008-2999 Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL comman… Aggregation Module Patch available Fix from $1,9502008-07-03 MEDIUM 6.8 CVE-2008-3000 The Aggregation module 5.x before 5.x-4.4 for Drupal, when node access modules are used, does not properly implement access control, which allows rem… Aggregation Module Patch available Fix from $1,6002008-07-03 HIGH 7.5 CVE-2008-2850 SQL injection vulnerability in the TrailScout module 5.x before 5.x-1.4 for Drupal allows remote attackers to execute arbitrary SQL commands via unsp… Trailscout Module Patch available Fix from $1,9502008-06-25 HIGH 7.5 CVE-2008-2772 The Magic Tabs module 5.x before 5.x-1.1 for Drupal allows remote attackers to execute arbitrary PHP code via unspecified URL arguments, possibly rel… Magic Tabs Module Patch available Fix from $1,9502008-06-18 MEDIUM 5.0 CVE-2008-2771 The Node Hierarchy module 5.x before 5.x-1.1 and 6.x before 6.x-1.0 for Drupal does not properly implement access checks, which allows remote attacke… Drupal Patch available Fix from $1,6002008-06-18 MEDIUM 5.8 CVE-2008-1729 The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, a… Drupal 6.2+ Fix from $1,6002008-04-11 HIGH 10.0 CVE-2008-0823 Unspecified vulnerability in the Header Image Module before 5.x-1.1 for Drupal allows remote attackers to access the administration pages via unknown… Header Image Patch available Fix from $1,9502008-02-19 HIGH 10.0 CVE-2008-0568 Unspecified vulnerability in the IP-authentication feature in the Secure Site 5.x-1.0 and 4.7.x-1.0 module for Drupal allows remote attackers to gain… Secure Site Module Patch available Fix from $1,9502008-02-05 MEDIUM 6.4 CVE-2008-0569 The Comment Upload 4.7.x before 4.7.x-0.1 and 5.x before 5.x-0.1 module for Drupal does not properly use functions in the upload module, which allows… Comment Upload Module Mitigation only Fix from $1,6002008-02-05 MEDIUM 6.4 CVE-2008-0577 The Project Issue Tracking module 5.x-2.x-dev before 20080130 in the 5.x-2.x series, 5.x-1.2 and earlier in the 5.x-1.x series, 4.7.x-2.6 and earlier… Project Issue Tracking Module Mitigation only Fix from $1,6002008-02-05 MEDIUM 5.0 CVE-2008-0570 The OpenID 5.x-1.0 and earlier module for Drupal does not properly verify the claimed_id returned by an OpenID provider, which allows remote OpenID p… Openid Mitigation only Fix from $1,6002008-02-05 HIGH 8.5 CVE-2008-0277 Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary cod… Fileshare Module No fix yet Fix from $1,9502008-01-15 MEDIUM 6.8 CVE-2008-0264 Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal, when images are permitted in node bodies, allows remote authent… Meta Tags Module after 5.x-1.6 Fix from $1,6002008-01-15 MEDIUM 5.0 CVE-2008-0275 The Atom 4.7 before 4.7.x-1.0 and 5.x before 5.x-1.0 module for Drupal does not properly manage permissions for node (1) titles, (2) teasers, and (3)… Atom Module after 5.0 Fix from $1,6002008-01-15 HIGH 7.5 CVE-2007-6299 Multiple SQL injection vulnerabilities in Drupal and vbDrupal 4.7.x before 4.7.9 and 5.x before 5.4 allow remote attackers to execute arbitrary SQL c… Drupal Patch available Fix from $1,9502007-12-10 MEDIUM 6.8 CVE-2007-5593 install.php in Drupal 5.x before 5.3, when the configured database server is not reachable, allows remote attackers to execute arbitrary code via vec… Drupal 5.3+ Fix from $1,6002007-10-19