CVE-2015-5489

The Drupal Smart Trim module (7.x-1.x) is affected by an XSS vulnerability in versions prior to 7.x-1.5 due to insufficient input filtering in the field settings form. This allows remote authenticated users with certain permissions to inject arbitrary script/HTML. Impact is partial integrity loss...

CVE-2015-5502

CVE-2015-5502 (Drupal Storage API module) details Affected software: Drupal Storage API module for Drupal 7.x, versions prior to 7.x-1.8 (7.x-1.x lineage). Root cause: The module did not properly restrict access to Storage API fields attached to entities that are not nodes. Impact: This allows re...

CVE-2015-5510

The CVE-2015-5510 entry concerns the Drupal Content Construction Kit (CCK) module. Affected: CCK 6.x-2.x before 6.x-2.10. Root cause: an open redirect vulnerability via the destinations parameter on certain admin pages, allowing remote attackers to redirect users to arbitrary sites (phishing risk...

CVE-2015-5513

Cross-site scripting XSS vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspecified vectors related to a login...

CVE-2015-5498

The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview admin/shipwire/shipments, which allows remote attackers to obtain sensitive information via a request to the page...

CVE-2015-5497

Cross-site scripting XSS vulnerability in the Web Links module 6.x-2.x before 6.x-2.6 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5487

The CVE-2015-5487 issue affects the Camtasia Relay module for Drupal (camtasia_relay), specifically versions 6.x-2.x prior to 6.x-3.2 and 7.x-2.x prior to 7.x-1.3. The root cause is insufficient sanitization of user input under the meta access tab, allowing remote authenticated users with the "vi...

CVE-2015-5500

Cross-site scripting XSS vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5514

The CVE-2015-5514 issue affects the Drupal Migrate module (7.x-2.x) prior to 7.x-2.8, specifically when the migrate_ui submodule is enabled. The root cause is insufficient sanitization of destination field labels, enabling user-assisted remote attackers to inject arbitrary web script or HTML. Pra...

CVE-2015-5506

The Apache Solr Real-Time module 7.x-1.x before 7.x-1.2 for Drupal does not check the status of an entity when indexing, which allows remote attackers to obtain information about unpublished content via a search...

CVE-2015-5504

CVE-2015-5504 describes an SQL injection in the Novalnet Payment Module Ubercart for Drupal. The vulnerability stems from failing to sanitize a database query via user-controlled input, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected products: Novalne...

CVE-2015-5508

CVE-2015-5508 refers to a CSRF vulnerability in The eXtensible Catalog (XC) Drupal Toolkit, specifically the XC NCIP Provider module. The issue arises because certain NCIP-Provider-related URLs aren’t sufficiently CSRF-protected, allowing an attacker to cause users with the administer ncip provid...

CVE-2015-5495

The CVE concerns the Drupal Mobile sliding menu module (7.x-2.x) prior to 7.x-2.1. It describes a cross-site scripting (XSS) vulnerability that can be exploited by remote authenticated users who have the 'administer menu' permission to inject arbitrary web script or HTML via unspecified vectors. ...

CVE-2015-5503

Open redirect vulnerability in the Chamilo integration module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters...

CVE-2015-5494

The CVE-2015-5494 entry covers a Cross-Site Scripting (XSS) vulnerability in the Webform Matrix Component module for Drupal (versions 7.x-4.x prior to 7.x-4.13). The issue arises from insufficient sanitization of user-supplied text, allowing remote authenticated users with certain permissions to ...

CVE-2015-5501

The Hostmaster Aegir module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

CVE-2015-5493

The CVE-2015-5493 entry describes a vulnerability in the Drupal Entityform Block module (7.x-1.x before 7.x-1.3). The root cause is improper permission checks when a form is locked to a role, enabling remote attackers to obtain access to certain entityforms via unspecified vectors. Affected softw...

CVE-2015-5512

The CVE-2015-5512 entry concerns the Drupal contributed module “me aliases.” The vulnerability affects me aliases 6.x-2.x prior to 6.x-2.10 and 7.x-1.x prior to 7.x-1.2, where the Views “me” user argument handler can be manipulated by substituting a user ID with the literal string “me” in a URL, ...

CVE-2015-5492

CVE-2015-5492 : A cross-site scripting (XSS) vulnerability was reported in the Drupal Video Consultation module, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected are all versions of the Video Consultation module (Drupal core not affected). The iss...