CVE-2008-1729

The menu system in Drupal 6 before 6.2 has incorrect menu settings, which allows remote attackers to (1) edit the profile pages of arbitrary users, and obtain sensitive information from (2) tracker and (3) blog pages, related to a missing check for the "access content" permission; and (4) allows remote authenticated users, with administration page view access, to edit content types.

• http://drupal.org/node/244637Patch, Vendor Advisory
• http://secunia.com/advisories/29762Third Party Advisory
• http://www.osvdb.org/44270Broken Link
• http://www.securityfocus.com/bid/28714Patch, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2008/1185/referencesThird Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41755Third Party Advisory, VDB Entry
• http://drupal.org/node/244637Patch, Vendor Advisory
• http://secunia.com/advisories/29762Third Party Advisory
• http://www.osvdb.org/44270Broken Link
• http://www.securityfocus.com/bid/28714Patch, Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2008/1185/referencesThird Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41755Third Party Advisory, VDB Entry

Published

Apr 11, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-1722Multiple integer overflows in (1) filter/image-png.c and (2)…
• CVE-2008-1724Stack-based buffer overflow in the IActiveXTransfer.FileTran…
• CVE-2008-1725The IBizEBank.FIProfile.1 ActiveX control in fiprofile20.ocx…
• CVE-2008-1726Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6…
• CVE-2008-1727KnowledgeQuest 2.5 and 2.6 does not require authentication f…
• CVE-2008-1728ConnectionManagerImpl.java in Ignite Realtime Openfire 3.4.5…
• CVE-2008-1730Directory traversal vulnerability in download.html in ARWScr…
• CVE-2008-1731The Simple Access module for Drupal 5.x through 5.x-1.2-2 do…
• CVE-2008-1732SQL injection vulnerability in showpredictionsformatch.php i…
• CVE-2008-1733SQL injection vulnerability in puarcade.class.php 2.2 and ea…
• CVE-2008-1734Interpretation conflict in PHP Toolkit before 1.0.1 on Gento…
• CVE-2008-1735BitDefender Antivirus 2008 20080118 and earlier allows local…