Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Drupal Subscribe
Filtered by product Drupal
Total 699 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2016-7572 1 Drupal 1 Drupal 2016-10-04 4.0 MEDIUM 4.3 MEDIUM
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
CVE-2016-7571 1 Drupal 1 Drupal 2016-10-04 4.3 MEDIUM 6.1 MEDIUM
Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.
CVE-2016-7570 1 Drupal 1 Drupal 2016-10-04 4.0 MEDIUM 4.3 MEDIUM
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
CVE-2016-3171 3 Debian, Drupal, Php 3 Debian Linux, Drupal, Php 2016-05-09 6.8 MEDIUM 8.1 HIGH
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
CVE-2016-3162 2 Debian, Drupal 2 Debian Linux, Drupal 2016-04-22 6.5 MEDIUM 8.1 HIGH
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
CVE-2016-3167 3 Debian, Drupal, Php 3 Debian Linux, Drupal, Php 2016-04-18 6.4 MEDIUM 7.4 HIGH
Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.
CVE-2016-3163 2 Debian, Drupal 2 Debian Linux, Drupal 2016-04-18 5.0 MEDIUM 7.5 HIGH
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
CVE-2016-3170 2 Debian, Drupal 2 Debian Linux, Drupal 2016-04-14 5.0 MEDIUM 5.3 MEDIUM
The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.
CVE-2016-3168 2 Debian, Drupal 2 Debian Linux, Drupal 2016-04-14 8.5 HIGH 6.4 MEDIUM
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
CVE-2016-3164 2 Debian, Drupal 2 Debian Linux, Drupal 2016-04-12 5.8 MEDIUM 7.4 HIGH
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
CVE-2016-3165 1 Drupal 1 Drupal 2016-04-12 5.0 MEDIUM 7.5 HIGH
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
CVE-2016-3166 2 Debian, Drupal 2 Debian Linux, Drupal 2016-04-12 4.3 MEDIUM 5.9 MEDIUM
CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
CVE-2016-3169 2 Debian, Drupal 2 Debian Linux, Drupal 2016-04-12 6.8 MEDIUM 8.1 HIGH
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
CVE-2014-5266 3 Debian, Drupal, Wordpress 3 Debian Linux, Drupal, Wordpress 2015-11-25 5.0 MEDIUM N/A
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
CVE-2014-5265 3 Debian, Drupal, Wordpress 3 Debian Linux, Drupal, Wordpress 2015-11-25 5.0 MEDIUM N/A
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVE-2013-1782 2 Devsaran, Drupal 2 Responsive Blog, Drupal 2015-11-24 2.1 LOW N/A
Cross-site scripting (XSS) vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
CVE-2015-8095 2 Drupal, Monster Menus Module Project 2 Drupal, Monster Menus 2015-11-10 5.0 MEDIUM N/A
The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern.
CVE-2011-2687 1 Drupal 1 Drupal 2015-09-03 7.5 HIGH N/A
Drupal 7.x before 7.3 allows remote attackers to bypass intended node_access restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.
CVE-2014-5267 1 Drupal 1 Drupal 2014-10-09 6.8 MEDIUM N/A
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
CVE-2014-5022 1 Drupal 1 Drupal 2014-07-22 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.