Vulnerabilities > Drupal > Drupal > 5.7
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2008-07-18 | CVE-2008-3220 | Cross-Site Request Forgery (CSRF) vulnerability in multiple products Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of "translated strings." | 4.3 |
| 2008-07-18 | CVE-2008-3219 | Cross-Site Scripting vulnerability in multiple products The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism. | 4.3 |
| 2008-07-03 | CVE-2008-2999 | SQL Injection vulnerability in Drupal Aggregation Module and Drupal Multiple SQL injection vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors. | 7.5 |
| 2008-07-03 | CVE-2008-2998 | Cross-Site Scripting vulnerability in Drupal Aggregation Module Multiple cross-site scripting (XSS) vulnerabilities in the Aggregation module 5.x before 5.x-4.4 for Drupal allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2008-03-04 | CVE-2008-1133 | Cross-Site Scripting vulnerability in Drupal The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS) attacks. | 4.3 |