Drupal — система управления контентом с открытым исходным кодом. На Drupal работает более миллиона сайтов — от личных блогов до сайтов компаний, политических партий и государственных организаций.
Релизный цикл, информация об уязвимостях
График релизов
Количество 2 030
CVE-2012-5651
Drupal 6.x before 6.27 and 7.x before 7.18 displays information for bl ...
CVE-2012-5652
Drupal 6.x before 6.27 allows remote attackers to obtain sensitive inf ...
CVE-2012-5653
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 ...
CVE-2012-5653
The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name.
CVE-2012-5652
Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result.
CVE-2012-5651
Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results.
CVE-2012-5589
The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link.
CVE-2012-5587
Cross-site scripting (XSS) vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the mailto link.
CVE-2012-5591
Cross-site scripting (XSS) vulnerability in the Zero Point module 6.x-1.x before 6.x-1.18 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the path aliases.
CVE-2012-5588
The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors.
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
| CVE-2012-5651 Drupal 6.x before 6.27 and 7.x before 7.18 displays information for bl ... | CVSS2: 5 | 3% Низкий | почти 14 лет назад |
| CVE-2012-5652 Drupal 6.x before 6.27 allows remote attackers to obtain sensitive inf ... | CVSS2: 5 | 2% Низкий | почти 14 лет назад |
| CVE-2012-5653 The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 ... | CVSS2: 6 | 2% Низкий | почти 14 лет назад |
 | CVE-2012-5653 The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the protection mechanism and execute arbitrary PHP code via a null byte in a file name. | CVSS2: 6 | 2% Низкий | почти 14 лет назад |
| CVE-2012-5652 Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed or (2) search result. | CVSS2: 5 | 2% Низкий | почти 14 лет назад |
| CVE-2012-5651 Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers to obtain sensitive information by reading the search results. | CVSS2: 5 | 3% Низкий | почти 14 лет назад |
 | CVE-2012-5589 The MultiLink module 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal does not properly check node permissions when generating an in-content link, which allows remote authenticated users with text-editing permissions to read arbitrary node titles via a generated link. | CVSS2: 3.5 | 1% Низкий | почти 14 лет назад |
| CVE-2012-5587 Cross-site scripting (XSS) vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the mailto link. | CVSS2: 4.3 | 1% Низкий | почти 14 лет назад |
| CVE-2012-5591 Cross-site scripting (XSS) vulnerability in the Zero Point module 6.x-1.x before 6.x-1.18 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the path aliases. | CVSS2: 4.3 | 1% Низкий | почти 14 лет назад |
| CVE-2012-5588 The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors. | CVSS2: 2.6 | 1% Низкий | почти 14 лет назад |
Уязвимостей на страницу