6.13 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:drupal:drupal:6.13:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2016-3169	264		+Priv	2016-04-12	2016-04-13	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array.
2	CVE-2016-3168	254			2016-04-12	2016-04-14	8.5	None	Remote	Medium	???	Complete	Complete	Complete
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
3	CVE-2016-3166			Http R.Spl.	2016-04-12	2016-04-13	4.3	None	Remote	Medium	Not required	None	Partial	None
CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
4	CVE-2016-3165	284		Bypass	2016-04-12	2016-04-13	5.0	None	Remote	Low	Not required	None	Partial	None
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
5	CVE-2016-3164				2016-04-12	2016-04-13	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
6	CVE-2016-3163	254			2016-04-12	2016-04-19	5.0	None	Remote	Low	Not required	None	Partial	None
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
7	CVE-2015-6661	200		+Info	2015-08-24	2016-12-24	5.0	None	Remote	Low	Not required	Partial	None	None
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
8	CVE-2015-6660	352		CSRF	2015-08-24	2016-12-24	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
9	CVE-2015-6658	79		XSS	2015-08-24	2016-12-24	4.3	None	Remote	Medium	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
10	CVE-2015-3234	20			2015-06-22	2016-12-03	4.3	None	Remote	Medium	Not required	None	Partial	None
The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows remote attackers to log into other users' accounts by leveraging an OpenID identity from certain providers, as demonstrated by the Verisign, LiveJournal, and StackExchange providers.
11	CVE-2015-2750	601			2017-09-13	2017-09-20	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence.
12	CVE-2015-2749	601			2017-09-13	2017-09-21	5.8	None	Remote	Medium	Not required	Partial	Partial	None
Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter.
13	CVE-2014-5267	264			2014-09-30	2014-10-10	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.
14	CVE-2014-5266	399		DoS	2014-08-18	2015-11-25	5.0	None	Remote	Low	Not required	None	None	Partial
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.
15	CVE-2014-5265	399		DoS	2014-08-18	2015-11-25	5.0	None	Remote	Low	Not required	None	None	Partial
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
16	CVE-2014-5021	79		XSS	2014-07-22	2014-07-22	2.1	None	Remote	High	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.
17	CVE-2014-5019	20		DoS	2014-07-22	2014-07-22	5.0	None	Remote	Low	Not required	None	None	Partial
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.
18	CVE-2014-1475				2014-01-24	2014-02-21	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors.
19	CVE-2013-6386	310		Bypass	2013-12-07	2014-01-14	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.
20	CVE-2013-6385	94		Exec Code CSRF	2013-12-07	2014-01-14	5.1	None	Remote	High	Not required	Partial	Partial	Partial
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.
21	CVE-2013-0245	264			2013-07-16	2017-08-29	2.1	None	Remote	High	???	Partial	None	None
The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.
22	CVE-2013-0244	79		XSS	2014-01-19	2014-03-08	2.6	None	Remote	High	Not required	None	Partial	None
Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.
23	CVE-2012-5653	20		Exec Code Bypass	2013-01-03	2017-08-29	6.0	None	Remote	Medium	???	Partial	Partial	Partial
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
24	CVE-2012-5652	200		+Info	2013-01-03	2017-08-29	5.0	None	Remote	Low	Not required	Partial	None	None
Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.
25	CVE-2012-5651	264		+Info	2013-01-03	2017-08-29	5.0	None	Remote	Low	Not required	Partial	None	None
Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.
26	CVE-2012-2922	200		+Info	2012-05-21	2017-08-29	5.0	None	Remote	Low	Not required	Partial	None	None
The request_path function in includes/bootstrap.inc in Drupal 7.14 and earlier allows remote attackers to obtain sensitive information via the q[] parameter to index.php, which reveals the installation path in an error message.
27	CVE-2012-0826	352		DoS CSRF	2013-10-28	2014-03-08	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors.
28	CVE-2012-0825	200		+Info	2013-10-28	2014-03-08	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
29	CVE-2010-3686	287		Bypass	2010-09-29	2010-09-30	5.0	None	Remote	Low	Not required	None	Partial	None
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not ensuring that fields are signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
30	CVE-2010-3685	287		Bypass	2010-09-29	2010-09-30	5.0	None	Remote	Low	Not required	None	Partial	None
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not checking for reuse of openid.response_nonce values, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
31	CVE-2010-3094	79		XSS	2010-09-21	2010-09-22	2.1	None	Remote	High	???	None	Partial	None
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the actions feature and the trigger module.
32	CVE-2010-3093	264		Bypass	2010-09-21	2010-09-22	3.5	None	Remote	Medium	???	None	Partial	None
The comment module in Drupal 5.x before 5.23 and 6.x before 6.18 allows remote authenticated users with certain privileges to bypass intended access restrictions and reinstate removed comments via a crafted URL, related to an "unpublishing bypass" issue.
33	CVE-2010-3092	264		Bypass	2010-09-21	2010-09-22	5.5	None	Remote	Low	???	Partial	Partial	None
The upload module in Drupal 5.x before 5.23 and 6.x before 6.18 does not properly support case-insensitive filename handling in a database configuration, which allows remote authenticated users to bypass the intended restrictions on downloading a file by uploading a different file with a similar name.
34	CVE-2010-3091	287		Bypass	2010-09-29	2010-09-30	5.0	None	Remote	Low	Not required	None	Partial	None
The OpenID module in Drupal 6.x before 6.18, and the OpenID module 5.x before 5.x-1.4 for Drupal, violates the OpenID 2.0 protocol by not verifying the openid.return_to value, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
35	CVE-2009-4370	79		XSS	2009-12-21	2017-08-17	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly handled in the menu administration overview.
36	CVE-2009-4369	79		XSS	2009-12-21	2017-08-17	3.5	None	Remote	Medium	???	None	Partial	None
Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script or HTML via the contact category name.
37	CVE-2007-6752	352	2	CSRF	2012-03-28	2012-03-28	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
DISPUTED Cross-site request forgery (CSRF) vulnerability in Drupal 7.12 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that end a session via the user/logout URI. NOTE: the vendor disputes the significance of this issue, by considering the "security benefit against platform complexity and performance impact" and concluding that a change to the logout behavior is not planned because "for most sites it is not worth the trade-off."

Total number of vulnerabilities : 37 Page : 1 (This Page)