Design/Logic Flaw

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...

Code injection

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

Cross site request forgery (csrf)

The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview admin/shipwire/shipments, which allows remote attackers to obtain sensitive information via a request to the page...

Cross site scripting

Cross-site scripting XSS vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5488

Cross-site scripting XSS vulnerability in the MailChimp Signup submodule in the MailChimp module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "administer mailchimp" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5502

The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors...

CVE-2015-5492

Cross-site scripting XSS vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5494

Cross-site scripting XSS vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5510

Open redirect vulnerability in the Content Construction Kit CCK 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destinations parameter, related to administration pages...

CVE-2015-5498

The Shipwire Drupal module 7.x-1.x is vulnerable (before 7.x-1.03) because it does not enforce the view permission for the shipments overview (admin/shipwire/shipments), allowing remote access to sensitive information. Affected: Shipwire 7.x-1.x prior to 7.x-1.03. Exploitation details are not pro...

CVE-2015-5514

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...

CVE-2015-5507

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5490

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...

CVE-2015-5496

CVE-2015-5496 affects the Drupal pass2pdf module. The vulnerability stems from PDFs generated during user registration not being access-restricted, allowing remote attackers to view password information via unspecified vectors (information disclosure). Affected: all versions of the pass2pdf modul...

CVE-2015-5505

The HTTP Strict Transport Security HSTS module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impac...

CVE-2015-5505

CVE-2015-5505 relates to Drupal’s contributed HTTP Strict Transport Security (HSTS) module. The module versions 6.x-1.x prior to 6.x-1.1 and 7.x-1.x prior to 7.x-1.2 do not correctly implement the include_subdomains directive, causing the HSTS policy not to be applied to subdomains. This is descr...

CVE-2015-5513

CVE-2015-5513 affects Drupal via the Shibboleth authentication module (versions 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2). The root cause is an XSS flaw allowing remote authenticated users with the Administer blocks permission to inject arbitrary scripts/HTML through an unspecified vecto...

CVE-2015-5507

The issue is a Cross-Site Scripting (XSS) vulnerability in the Drupal contributed module Inline Entity Form (7.x-1.x) prior to 7.x-1.6. The module does not sufficiently sanitize user-supplied text, allowing remote authenticated users with permission to create or edit fields to inject arbitrary sc...

CVE-2015-5506

The vulnerability CVE-2015-5506 affects the Drupal Apache Solr Real-Time module (7.x-1.x) prior to 7.x-1.2. The root cause is that the module does not check the status of an entity when indexing, allowing remote attackers to retrieve information about unpublished content through search results. I...

CVE-2015-5488

CVE-2015-5488 is a cross-site scripting vulnerability in Drupal’s MailChimp module (significant for the MailChimp Signup submodule) in 7.x-3.x before 7.x-3.3. The issue allows remote authenticated users with the administrator privilege (administer mailchimp) to inject arbitrary script/HTML via un...