Vulnerabilities > Drupal > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2016-04-12 | CVE-2016-3162 | Improper Access Control vulnerability in multiple products The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files. | 6.5 |
| 2015-11-09 | CVE-2015-8095 | Information Exposure vulnerability in Monster Menus Module Project Monster Menus The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern. | 5.0 |
| 2015-08-24 | CVE-2015-6665 | Cross-site Scripting vulnerability in multiple products Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag. | 4.3 |
| 2015-08-24 | CVE-2015-6661 | Information Exposure vulnerability in Drupal Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. | 5.0 |
| 2015-08-24 | CVE-2015-6660 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks." | 6.8 |
| 2015-08-24 | CVE-2015-6658 | Cross-site Scripting vulnerability in Drupal Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. | 4.3 |
| 2015-06-22 | CVE-2015-3234 | Improper Input Validation vulnerability in multiple products The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers. | 4.3 |
| 2015-06-22 | CVE-2015-3233 | Open Redirection vulnerability in Drupal Core Overlay Module Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. network drupal | 5.8 |
| 2015-06-22 | CVE-2015-3232 | Open Redirection vulnerability in Drupal Field UI Module Open redirect vulnerability in the Field UI module in Drupal 7.x before 7.38 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destinations parameter. | 5.8 |
| 2015-06-22 | CVE-2015-3231 | Information Exposure vulnerability in multiple products The Render cache system in Drupal 7.x before 7.38, when used to cache content by user role, allows remote authenticated users to obtain private content viewed by user 1 by reading the cache. | 4.0 |