Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 030
CVE-2013-6389
Open redirect vulnerability in the Overlay module in Drupal 7.x before ...
CVE-2013-6385
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used ...
CVE-2013-6386
Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack.
CVE-2013-6389
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2013-6385
The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors.
CVE-2012-0825
Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
CVE-2012-0827
The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors.
CVE-2012-0826
Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors.
CVE-2012-0825
Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attrib ...
CVE-2012-0826
Cross-site request forgery (CSRF) vulnerability in the Aggregator modu ...
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2013-6389 Open redirect vulnerability in the Overlay module in Drupal 7.x before ... | CVSS2: 5.8 | 1% Низкий | почти 13 лет назад |
| CVE-2013-6385 The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used ... | CVSS2: 5.1 | 3% Низкий | почти 13 лет назад |
 | CVE-2013-6386 Drupal 6.x before 6.29 and 7.x before 7.24 uses the PHP mt_rand function to generate random numbers, which uses predictable seeds and allows remote attackers to predict security strings and bypass intended restrictions via a brute force attack. | CVSS2: 6.8 | 2% Низкий | почти 13 лет назад |
| CVE-2013-6389 Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | CVSS2: 5.8 | 1% Низкий | почти 13 лет назад |
| CVE-2013-6385 The form API in Drupal 6.x before 6.29 and 7.x before 7.24, when used with unspecified third-party modules, performs form validation even when CSRF validation has failed, which might allow remote attackers to trigger application-specific impacts such as arbitrary code execution via application-specific vectors. | CVSS2: 5.1 | 3% Низкий | почти 13 лет назад |
 | CVE-2012-0825 Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack. | CVSS2: 6.8 | 2% Низкий | около 13 лет назад |
| CVE-2012-0827 The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors. | CVSS2: 3.5 | 1% Низкий | около 13 лет назад |
| CVE-2012-0826 Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors. | CVSS2: 6.8 | 1% Низкий | около 13 лет назад |
| CVE-2012-0825 Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attrib ... | CVSS2: 6.8 | 2% Низкий | около 13 лет назад |
| CVE-2012-0826 Cross-site request forgery (CSRF) vulnerability in the Aggregator modu ... | CVSS2: 6.8 | 1% Низкий | около 13 лет назад |
Уязвимостей на страницу