Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 988
CVE-2015-6661
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu.
CVE-2015-6661
Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to ...
CVE-2015-6660
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."
CVE-2015-6660
The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not pr ...
CVE-2015-6659
SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment.
CVE-2015-6659
SQL injection vulnerability in the SQL comment filtering system in the ...
CVE-2015-6658
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
CVE-2015-6658
Cross-site scripting (XSS) vulnerability in the Autocomplete system in ...
CVE-2015-6658
Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.
CVE-2015-6665
Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2015-6661 Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. | CVSS2: 5 | 1% Низкий | больше 10 лет назад |
| CVE-2015-6661 Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to ... | CVSS2: 5 | 1% Низкий | больше 10 лет назад |
| CVE-2015-6660 The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks." | CVSS2: 6.8 | 0% Низкий | больше 10 лет назад |
| CVE-2015-6660 The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not pr ... | CVSS2: 6.8 | 0% Низкий | больше 10 лет назад |
| CVE-2015-6659 SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment. | CVSS2: 7.5 | 14% Средний | больше 10 лет назад |
| CVE-2015-6659 SQL injection vulnerability in the SQL comment filtering system in the ... | CVSS2: 7.5 | 14% Средний | больше 10 лет назад |
| CVE-2015-6658 Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. | CVSS2: 4.3 | 1% Низкий | больше 10 лет назад |
| CVE-2015-6658 Cross-site scripting (XSS) vulnerability in the Autocomplete system in ... | CVSS2: 4.3 | 1% Низкий | больше 10 лет назад |
 | CVE-2015-6658 Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files. | CVSS2: 4.3 | 1% Низкий | больше 10 лет назад |
| CVE-2015-6665 Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag. | CVSS2: 4.3 | 1% Низкий | больше 10 лет назад |
Уязвимостей на страницу