Vulnerabilities > Drupal > Drupal > 6.36
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2015-08-24 | CVE-2015-6661 | Information Exposure vulnerability in Drupal Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. | 5.0 |
| 2015-08-24 | CVE-2015-6660 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks." | 6.8 |
| 2015-08-24 | CVE-2015-6658 | Cross-site Scripting vulnerability in Drupal Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. | 4.3 |
| 2012-05-21 | CVE-2012-2922 | Information Exposure vulnerability in Drupal The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message. | 5.0 |
| 2009-09-24 | CVE-2009-3352 | Unspecified vulnerability in Drupal Multiple unspecified vulnerabilities in the quota_by_role (Quota by role) module for Drupal have unknown impact and attack vectors. | 10.0 |