U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): cpe:2.3:a:drupal:drupal:6.20:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 225 matching records.
Displaying matches 221 through 225.
Vuln ID Summary CVSS Severity
CVE-2008-4633

SQL injection vulnerability in Node Vote 5.x before 5.x-1.1 and 6.x before 6.x-1.0, a module for Drupal, when "Allow user to vote again" is enabled, allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to a "previously cast vote."

Published: October 20, 2008; 9:18:02 PM -0400 		V3.x:(not available)
 V2.0: 6.0 MEDIUM
CVE-2008-2629

SQL injection vulnerability in the LifeType (formerly pLog) module for Drupal allows remote attackers to execute arbitrary SQL commands via the albumId parameter in a ViewAlbum action to index.php.

Published: June 09, 2008; 8:32:00 PM -0400 		V3.x:(not available)
 V2.0: 7.5 HIGH
CVE-2008-1792

Cross-site scripting (XSS) vulnerability in the insertion filter in the Flickr Drupal module 5.x before 5.x-1.3 and 6.x before 6.x-1.0-alpha allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: April 15, 2008; 1:05:00 PM -0400 		V3.x:(not available)
 V2.0: 4.3 MEDIUM
CVE-2008-1731

The Simple Access module for Drupal 5.x through 5.x-1.2-2 does not properly handle the privacy information for nodes, which might allow remote attackers to bypass intended access restrictions, and read or modify nodes, in opportunistic circumstances related to interaction between Simple Access and (1) Node clone or (2) Project issue tracking.

Published: April 11, 2008; 3:05:00 PM -0400 		V3.x:(not available)
 V2.0: 7.5 HIGH
CVE-2008-0462

Cross-site scripting (XSS) vulnerability in the Archive 5.x before 5.x-1.8 module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Published: January 25, 2008; 11:00:00 AM -0500 		V3.x:(not available)
 V2.0: 4.3 MEDIUM