Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 030
CVE-2014-5265
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVE-2014-5022
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.
CVE-2014-5020
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.
CVE-2014-5021
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label.
CVE-2014-5019
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use.
CVE-2014-5021
Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x ...
CVE-2014-5022
Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal ...
CVE-2014-5020
The File module in Drupal 7.x before 7.29 does not properly check perm ...
CVE-2014-5019
The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 al ...
CVE-2014-5020
The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2014-5265 The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564. | CVSS2: 5 | 3% Низкий | около 12 лет назад |
 | CVE-2014-5022 Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field. | CVSS2: 4.3 | 1% Низкий | больше 12 лет назад |
| CVE-2014-5020 The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field. | CVSS2: 4.9 | 1% Низкий | больше 12 лет назад |
| CVE-2014-5021 Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via an option group label. | CVSS2: 2.1 | 1% Низкий | больше 12 лет назад |
| CVE-2014-5019 The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 allows remote attackers to cause a denial of service via a crafted HTTP Host header, related to determining which configuration file to use. | CVSS2: 5 | 3% Низкий | больше 12 лет назад |
| CVE-2014-5021 Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x ... | CVSS2: 2.1 | 1% Низкий | больше 12 лет назад |
| CVE-2014-5022 Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal ... | CVSS2: 4.3 | 1% Низкий | больше 12 лет назад |
| CVE-2014-5020 The File module in Drupal 7.x before 7.29 does not properly check perm ... | CVSS2: 4.9 | 1% Низкий | больше 12 лет назад |
| CVE-2014-5019 The multisite feature in Drupal 6.x before 6.32 and 7.x before 7.29 al ... | CVSS2: 5 | 3% Низкий | больше 12 лет назад |
| CVE-2014-5020 The File module in Drupal 7.x before 7.29 does not properly check permissions to view files, which allows remote authenticated users with certain permissions to bypass intended restrictions and read files by attaching the file to content with a file field. | CVSS2: 4.9 | 1% Низкий | больше 12 лет назад |
Уязвимостей на страницу