NVD List
| Id | Name | Description | Reject | CVSS Version | CVSS Score | Severity | Pub Date | Modified Date | Actions |
|---|---|---|---|---|---|---|---|---|---|
| 19011 | CVE-2016-3166 | CRLF injection vulnerability in the drupal_set_header function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers. | 2 | 4.3 | Medium | 2017-01-19 | 2016-04-12 | View | |
| 19012 | CVE-2016-3167 | Open redirect vulnerability in the drupal_goto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter. | 2 | 6.4 | Medium | 2017-01-19 | 2016-04-18 | View | |
| 19013 | CVE-2016-3168 | The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability." | 2 | 8.5 | High | 2017-01-19 | 2016-04-14 | View | |
| 19014 | CVE-2016-3169 | The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the user_save function with an explicit category and loads all roles into the array. | 2 | 6.8 | Medium | 2017-01-19 | 2016-04-12 | View | |
| 19015 | CVE-2016-3170 | The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in. | 2 | 5 | Medium | 2017-01-19 | 2016-04-14 | View |
Page 15727 of 17672, showing 5 records out of 88360 total, starting on record 78631, ending on 78635
