Unscored DSA-2776-1 7 CVEs

drupal6 - several

Published Oct 11, 2013 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 6.0	drupal6	6.28-1

Vulnerabilities 7

Unscored —

CVE-2012-0825

Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which al…

Oct 28, 2013
Unscored —

CVE-2012-0826

Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 …

Oct 28, 2013
Unscored —

CVE-2012-5651

Drupal 6.x before 6.27 and 7.x before 7.18 displays information for blocked users, which might allow remote attackers t…

Jan 3, 2013
Unscored —

CVE-2012-5652

Drupal 6.x before 6.27 allows remote attackers to obtain sensitive information about uploaded files via a (1) RSS feed …

Jan 3, 2013
Unscored —

CVE-2012-5653

The file upload feature in Drupal 6.x before 6.27 and 7.x before 7.18 allows remote authenticated users to bypass the p…

Jan 3, 2013
Unscored —

CVE-2013-0244

Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older version…

Jan 19, 2014
Unscored —

CVE-2013-0245

The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not pr…

Jul 16, 2013