Services Project Services — known CVE vulnerabilities

Every CVE whose affected-product data names Services Project Services, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (6)

• CVE-2014-9151 — CVSS 7.5 (high): The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier…
• CVE-2014-9152 — CVSS 7.5 (high): The _user_resource_create function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user…
• CVE-2013-2158 — CVSS 6.8 (medium): Cross-site request forgery (CSRF) vulnerability in the Services module 6.x-3.x and 7.x-3.x before 7.x-3.4 for Drupal allows remote…
• CVE-2015-4393 — CVSS 6.0 (medium): The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with…
• CVE-2015-4394 — CVSS 5.0 (medium): The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the field_access restriction and obtain sensitive…
• CVE-2014-9153 — CVSS 4.3 (medium): Cross-site scripting (XSS) vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to…