Drupal Commerce Commonwealth module authentication bypass vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. commerce Commonwealth is one of the modules that integrates the Commonwealth Bank of Australia CBA into the Drupal e-commerce payment and settlement system. An authentication bypass...

Drupal Compass Rose Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Compass Rose is one of the direction compass modules. A cross-site scripting vulnerability exists in version 6.x-1.0 of the Drupal Compass Rose module, which can be exploited by an...

http-drupal-enum NSE Script

Enumerates the installed Drupal modules/themes by using a list of known modules and themes. The script works by iterating over module/theme names and requesting MODULEPATH/MODULENAME/LICENSE.txt for modules and THEMEPATH/THEMENAME/LICENSE.txt. MODULEPATH/THEMEPATH which is either provided by the...

[SECURITY] Fedora 21 Update: drupal6-cck-2.10-1.fc21

The Content Construction Kit allows you to add custom fields to custom content types using a web interface. In Drupal 5.x, custom content types can be created in Drupal core, and the Content Construction Kit allows you to add custom fields to any content type. In Drupal 7 and later, most of the...

[SECURITY] Fedora 22 Update: drupal6-cck-2.10-1.fc22

The Content Construction Kit allows you to add custom fields to custom content types using a web interface. In Drupal 5.x, custom content types can be created in Drupal core, and the Content Construction Kit allows you to add custom fields to any content type. In Drupal 7 and later, most of the...

Compass Rose - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-138

Compass Rose module provides a type of CCK field that allows to represent the most common orientations North, North-East, East, South-East, South, South-West, West and North-West. The module was embedding a JavaScript library from an external source that was not reliable, thereby exposing the sit...

Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136

This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway. The module doesn't sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment...

Quick Edit - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-137

This module enables you to in-place edit entities' fields. The module doesn't sufficiently filter entity titles under the scenario where the user starts in-place editing an entity. The module also doesn't sufficiently filter node titles under the scenario where a node is displayed albeit only on...

[SECURITY] Fedora 22 Update: drupal7-path_breadcrumbs-3.3-1.fc22

Path breadcrumbs module helps you to create breadcrumbs for any page with a ny selection rules and load any entity from the URL. Features Breadcrumbs navigation may be added to any kind of page: static example: node/1 or dynamic example: node/NID. You can load contexts from URL and use it like...

[SECURITY] Fedora 21 Update: drupal7-path_breadcrumbs-3.3-1.fc21

Path breadcrumbs module helps you to create breadcrumbs for any page with a ny selection rules and load any entity from the URL. Features Breadcrumbs navigation may be added to any kind of page: static example: node/1 or dynamic example: node/NID. You can load contexts from URL and use it like...

Drupal OSF for Drupal Module Arbitrary File Deletion Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. osf for Drupal is one of the middle-tier modules that allows customization tools and data display for internally structured data RDF and related vocabularies ontologies. An arbitrary...

Drupal OSF for Drupal module cross-site request forgery vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. osf for Drupal is one of the middle-tier modules that allows customization tools and data display for internally structured data RDF and related vocabularies ontologies. A cross-site...

Drupal OSF for Drupal Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. osf for Drupal is one of the middle-tier modules that allows customization tools and data display for internally structured data RDF and related vocabularies ontologies. A cross-site...

Drupal Time Tracker Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Time Tracker is one of the time tracking system modules. A cross-site scripting vulnerability exists in the Drupal Time Tracker module, which stems from the program's failure to...

Drupal Administration Views Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP.Administration Views is a module for replacing administration overview or list pages. A security vulnerability exists in the Drupal Administration Views module that allows remote attackers to submit special requests to obtai...

Several Critical Flaws Patched in Drupal Module

There are several critical vulnerabilities in a middleware layer used in Drupal, including both cross-site scripting and cross-site request forgery bugs, that can be exploited remotely. The vulnerabilities are in the Open Semantic Framework, which is a third-party project and not part of the Drup...

OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134

The Open Semantic Framework OSF for Drupal is a middleware layer that allows structured data RDF and associated vocabularies ontologies to "drive" tailored tools and data displays within Drupal. The module is vulnerable to reflected Cross Site Scripting XSS because it did not sufficiently filter...

Drupal Path Breadcrumbs Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Path Breadcrumbs is one of the website breadcrumb path modules. A cross-site scripting vulnerability exists in the Drupal Path Breadcrumbs module in versions 7.x-3.3 prior to 7.x-3.x. T...

Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135

This module enables you to track time on entities and comments. The module doesn't sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Add Time...

The vulnerability of the Debian GNU/Linux operating system allows a perpetrator to gain access to information processed by the previous user.

Vulnerability of the Drupal subsystem of the Debian GNU/Linux operating system, with no protection for service data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to access information processed by the previous user, through analysis of the cache...