CVE-2015-4353

Cross-site request forgery CSRF vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors...

CVE-2015-4354

CVE-2015-4354 is an XSS vulnerability in the Drupal Ubercart Webform Integration module (affected: version 6.x-1.8 and 7.x before 7.x-2.4). The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, due to insufficient inpu...

CVE-2015-4366

Cross-site scripting XSS vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4356

Cross-site scripting XSS vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform...

CVE-2015-4382

CVE-2015-4382 refers to CSRF vulnerabilities in the Drupal Invoice contributed module. Impacted versions are 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3, allowing remote attackers to hijack the authentication of arbitrary users to perform invoices-related actions (create, delete, or alt...

CVE-2015-4346

Cross-site scripting XSS vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews...

CVE-2015-4370

Cross-site scripting XSS vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4347

CVE-2015-4347 describes a cross-site scripting (XSS) vulnerability in Drupal’s inLinks Integration module. The issue arises from insufficient sanitization of user input in some path arguments, allowing remote attackers to inject arbitrary web script or HTML. The advisory indicates the vulnerabili...

CVE-2015-4389

The CVE concerns the Drupal contributed module Open Graph Importer (og_tag_importer) in the 7.x-1.x line. The root cause is improper enforcement of the create permission on destination content types during import, enabling remote authenticated users with the import_og_tag_importer permission to b...

CVE-2015-4387

Cross-site scripting XSS vulnerability in unspecified administration pages in the Password Policy module 6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11 for Drupal, when a site has a policy that uses the username constraint, allows remote attackers to inject arbitrary web script or HTML via a...

CVE-2015-4380

CVE-2015-4380 affects Drupal via the Linear Case module (6.x-1.x) prior to 6.x-1.3. Root cause: insufficient sanitization of user-supplied input in certain Linear Case pages. Impact: XSS vulnerability that could be exploited by remote authenticated users with specific permissions to inject arbitr...

CVE-2015-4362

The CVE-2015-4362 vulnerability affects the Drupal Tracking Code module (7.x-1.x) prior to 7.x-1.6. It is a CSRF flaw in tracking_code.admin.inc that could allow an attacker to hijack an administrator’s session to disable tracking codes. The fixed version is 7.x-1.6. If using this module on Drupa...

CVE-2015-4364

CVE-2015-4364 covers CSRF flaws in the Drupal Campaign Monitor module (7.x-1.0)—specifically in includes/campaignmonitor_lists.admin.inc—that allow remote attackers to hijack a user’s authentication to enable or disable list subscriptions via URLs like /admin/config/services/campaignmonitor/lists...

CVE-2015-4388

Cross-site scripting XSS vulnerability in the Current Search Links module 7.x-1.x before 7.x-1.1 for Drupal, when the "Append the keywords passed by the user to the list" option is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted search query...

CVE-2015-4390

The vulnerability CVE-2015-4390 affects the Drupal contributed module User Import (versions 6.x-4.x prior to 6.x-4.4 and 7.x-2.x prior to 7.x-2.3). A Cross-Site Request Forgery (CSRF) flaw exists in management URLs that could trick an administrator into continuing or deleting an ongoing import, e...

CVE-2015-4357

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...

CVE-2015-4382

Multiple cross-site request forgery CSRF vulnerabilities in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 create, 2 delete, or 3 alter invoices via unspecified vectors...

CVE-2015-4357

The CVE-2015-4357 vulnerability affects the Drupal Webform contributed module. Specifically, Webform 6.x prior to 6.x-3.22, 7.x prior to 7.x-3.22, and 7.x-4.x prior to 7.x-4.4 allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title that is...

CVE-2015-4352

Cross-site request forgery CSRF vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors...

CVE-2015-4367

The CVE-2015-4367 issue affects the Drupal Simple Subscription module (6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1). The root cause is inadequate filtering/sanitization of user-submitted content in block content, enabling an authenticated user with the administer blocks permission to inject...