Vulnerabilities > Drupal > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-08-31 | CVE-2012-2117 | Cross-Site Scripting vulnerability in Yaniv Aran-Shamir Gigya Cross-site scripting (XSS) vulnerability in the Gigya - Social optimization module 6.x before 6.x-3.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2012-08-31 | CVE-2012-2116 | Cross-Site Request Forgery (CSRF) vulnerability in Commerceguys Commerce Reorder 7.X1.0/7.X1.X Cross-site request forgery (CSRF) vulnerability in the Commerce Reorder module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that add items to the shopping cart. | 6.8 |
| 2012-08-31 | CVE-2012-2083 | Cross-Site Scripting vulnerability in Fusiondrupalthemes Fusion 6.X1.0/6.X1.1/6.X1.12 Cross-site scripting (XSS) vulnerability in the fusion_core_preprocess_page function in fusion_core/template.php in the Fusion module before 6.x-1.13 for Drupal allows remote attackers to inject arbitrary web script or HTML via the q parameter. | 4.3 |
| 2012-08-31 | CVE-2012-2704 | Permissions, Privileges, and Access Controls vulnerability in John Franklin Advertisement The Advertisement module 6.x-2.x before 6.x-2.3 for Drupal does not properly restrict access to debug information, which allows remote attackers to obtain sensitive site configuration information that is specified by the $conf variable in settings.php. | 5.0 |
| 2012-08-28 | CVE-2012-1650 | Permissions, Privileges, and Access Controls vulnerability in Giantrobot Zipcart 6.X1.2/6.X1.3/6.X1.X The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions. | 6.0 |
| 2012-08-28 | CVE-2012-1647 | Cross-Site Scripting vulnerability in Mediafront Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via (1) $_SERVER['HTTP_HOST'] or (2) $_SERVER['SCRIPT_NAME'] to players/osmplayer/player/OSMPlayer.php, (3) playlist parameter to players/osmplayer/player/getplaylist.php, and possibly other vectors related to $_SESSION. | 4.3 |
| 2012-08-28 | CVE-2012-1643 | Permissions, Privileges, and Access Controls vulnerability in Jason Savino FP 7.X1.0/7.X1.1 The Faster Permissions module 7.x-2.x before 7.x-1.2 for Drupal does not check the "administer permissions" permission, which allows remote attackers to modify access permissions via unspecified vectors. | 5.0 |
| 2012-08-28 | CVE-2012-1642 | Permissions, Privileges, and Access Controls vulnerability in Yaml-Fuer-Drupal Linkchecker includes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does not properly enforce access permissions on broken links, which allows remote attackers to obtain sensitive information via unspecified vectors. | 5.0 |
| 2012-08-28 | CVE-2012-1641 | Permissions, Privileges, and Access Controls vulnerability in Danielb Finder The finder_import function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import. | 6.0 |
| 2012-08-28 | CVE-2012-1635 | Permissions, Privileges, and Access Controls vulnerability in RIK DE Boer Revisioning The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content. | 6.4 |