Drupal Spider Contacts Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP.Spider Contacts is a contact component. A cross-site request forgery vulnerability exists in the Drupal Spider Contacts module that allows remote attackers to construct malicious URIs, trick users into parsing them, and can...

drupal -- multiple vulnerabilities

Drupal development team reports: Impersonation OpenID module - Drupal 6 and 7 - Critical A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts. This vulnerability is mitigated by the fa...

Drupal Password Policy Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP.Password Policy is a module that provides more advanced password complexity detection capabilities. The Drupal Password Policy module has a cross-site scripting vulnerability when a website uses a username constraint policy ...

Drupal Webform module cross-site scripting vulnerability (CNVD-2015-03860)

Drupal is a free and open source content management system developed in PHP. webform is a market research questionnaire module. The Drupal Webform module handles view-based webform result forms with a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to...

Inline Entity Form - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-120

The Inline Entity Form module provides a field widget for inline management creation, modification, removal of referenced entities. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that ...

Content Construction Kit (CCK) - Less Critical - Open Redirect - SA-CONTRIB-2015-126

The Content Construction Kit CCK project is a set of modules that allows you to add custom fields to nodes using a web browser. CCK uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain...

Acquia Cloud Site Factory Connector - Less Critical - Open Redirect - SA-CONTRIB-2015-125

Acquia Cloud Site Factory provides an environment and a robust set of tools that simplify management of many Drupal sites, allowing you to quickly deliver and manage any number of websites. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an ope...

LABjs - Less Critical - Open Redirect - SA-CONTRIB-2015-124

The LABjs module integrates LABjs with Drupal for web performance optimization. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack see SA-CORE-2015-002. Only sites with the Overlay module enabled are vulnerable. CVE...

Administration Views - Moderately Critical - Access Bypass - SA-CONTRIB-2015-122

This module replaces administrative overview/listing pages with Views for improved usability. When combined with other contributed or custom modules, the Administration Views module improperly grants users access to administration pages including the permissions page. This vulnerability is...

Open redirect

Open redirect vulnerability in the Chaos tool suite ctools module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors involving processing confirmation delete pages...

CVE-2015-4398

Open redirect vulnerability in the Chaos tool suite ctools module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors involving processing confirmation delete pages...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient To address of an ema...

CVE-2015-4374

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient To address of an ema...

CVE-2015-4398

CVE-2015-4398 is an open redirect vulnerability in the Chaos Tool Suite (ctools) Drupal module. Affected versions are CTools 6.x-1.x prior to 6.x-1.12 and 7.x-1.x prior to 7.x-1.7. The root cause is improper sanitization of URLs processed on confirmation delete pages, enabling remote attackers to...

CVE-2015-4374

CVE-2015-4374 describes a cross-site scripting (XSS) vulnerability in the Drupal Webform module. The issue allows remote authenticated users with certain permissions to inject arbitrary script/HTML via a component name in the recipient (To) address used for emails sent by Webform. Affected are Dr...

CVE-2015-4398

Open redirect vulnerability in the Chaos tool suite ctools module before 6.x-1.12 and 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors involving processing confirmation delete pages...

CVE-2015-4397

Cross-site request forgery CSRF vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors...

CVE-2015-4395

The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the...

CVE-2015-4396

Multiple cross-site request forgery CSRF vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that 1 create, 2 delete, or 3 set priorities to...

CVE-2015-4393

The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename...