Vulnerabilities > Drupal
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2008-02-05 | CVE-2008-0568 | Authentication Bypass vulnerability in Drupal Secure Site Module 4.7/5.0 Unspecified vulnerability in the IP-authentication feature in the Secure Site 5.x-1.0 and 4.7.x-1.0 module for Drupal allows remote attackers to gain the privileges of a user who has authenticated from behind the same proxy server as the attacker. | 10.0 |
| 2008-01-25 | CVE-2008-0463 | Cross-Site Scripting vulnerability in Drupal Workflow Cross-site scripting (XSS) vulnerability in the Workflow 4.7.x before 4.7.x-1.2 and 5.x before 5.x-1.2 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving node properties. | 4.3 |
| 2008-01-25 | CVE-2008-0462 | Cross-Site Scripting vulnerability in Drupal Archive Module and Drupal Cross-site scripting (XSS) vulnerability in the Archive 5.x before 5.x-1.8 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2008-01-15 | CVE-2008-0277 | Improper Input Validation vulnerability in Drupal Fileshare Module 4.7.X/5.X Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary code via unspecified vectors. | 8.5 |
| 2008-01-15 | CVE-2008-0276 | Cross-Site Scripting vulnerability in Drupal Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via a site variable, related to lack of escaping of the variable table. | 4.3 |
| 2008-01-15 | CVE-2008-0275 | Permissions, Privileges, and Access Controls vulnerability in Drupal Atom Module The Atom 4.7 before 4.7.x-1.0 and 5.x before 5.x-1.0 module for Drupal does not properly manage permissions for node (1) titles, (2) teasers, and (3) bodies, which might allow remote attackers to gain access to syndicated content. | 5.0 |
| 2008-01-15 | CVE-2008-0274 | Cross-Site Scripting vulnerability in Drupal 4.7/5.0 Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files. | 2.6 |
| 2008-01-15 | CVE-2008-0273 | Cross-Site Scripting vulnerability in Drupal Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism. | 4.3 |
| 2008-01-15 | CVE-2008-0272 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cross-site request forgery (CSRF) vulnerability in the aggregator module in Drupal 4.7.x before 4.7.11 and 5.x before 5.6 allows remote attackers to delete items from a feed as privileged users. | 4.3 |
| 2008-01-15 | CVE-2008-0271 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Bueditor The editor deletion form in BUEditor 4.7.x before 4.7.x-1.0 and 5.x before 5.x-1.1, a module for Drupal, does not follow Drupal's Forms API submission model, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete custom editor interfaces. | 4.3 |