CVE-2015-4383

The CVE-2015-4383 issue affects the Drupal Decisions module. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Decisions that allows an attacker to cause an authenticated user to remove individual voters via crafted requests (unspecified vectors). Root cause: insufficient CSRF prot...

CVE-2015-4354

Cross-site scripting XSS vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4369

Cross-site scripting XSS vulnerability in the Trick Question module before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with the "Administer Trick Question" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4373

Summary: CVE-2015-4373 is a cross-site scripting (XSS) vulnerability in the OG Tabs contributed module for Drupal 7.x, affecting versions prior to 7.x-1.1. Affected component: OG Tabs module (Drupal 7.x). Root cause / vulnerability detail: Module does not sufficiently sanitize user-supplied text ...

CVE-2015-4355

Cross-site request forgery CSRF vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors...

CVE-2015-4384

CVE-2015-4384 describes a cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module for Drupal. The issue affects Ubercart Webform Checkout Pane 6.x-3.x up to before 6.x-3.10 and 7.x-3.x up to before 7.x-3.11, arising because the module does not sufficiently sanitize u...

CVE-2015-4361

CVE-2015-4361 is a CSRF vulnerability in Drupal’s Registration codes module (before 6.x-1.6, affects 6.x-1.x/6.x-2.x/7.x-1.x branches). The issue permits remote attackers to hijack administrator sessions to issue requests that delete registration codes via unspecified vectors. Remediation per con...

CVE-2015-4370

CVE-2015-4370 is a XSS in the Drupal Site Documentation module (6.x-1.x) prior to 6.x-1.5. Root cause: insufficient sanitization of user-supplied text on certain pages, exploitable by remote authenticated users with permission to create/edit taxonomy terms. Impact: arbitrary script/HTML injection...

CVE-2015-4380

Cross-site scripting XSS vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4348

SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-4349

Cross-site request forgery CSRF vulnerability in the Spider Contacts module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete contact categories via unspecified vectors...

CVE-2015-4349

CVE-2015-4349 affects the Drupal Spider Contacts module. It is a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to hijack administrator actions for requests that delete contact categories. The issue is tied to the Spider Contacts module (not Drupal core) and is mitigated...

CVE-2015-4386

The CVE-2015-4386 entry refers to a Drupal EntityBulkDelete module vulnerability (7.x-1.0) involving multiple XSS flaws in unspecified administration pages. The root cause is insufficient sanitization of user-supplied text in admin interfaces, which could allow remote attackers to inject arbitrar...

CVE-2015-4396

CVE-2015-4396 affects Drupal Keyword Research module (6.x-1.x) prior to 6.x-1.2. Root cause: CSRF vulnerabilities allow remote attackers to hijack the authentication of users with the kwak research admin site keywords permission, enabling actions that create, delete, or set priorities on keywords...

CVE-2015-4350

The CVE-2015-4350 entry concerns Drupal’s Spider Catalog contributed module, which has CSRF vulnerabilities. The root cause is insufficient CSRF protection on certain URLs, allowing remote attackers to trigger administrator actions that delete products, ratings, or categories. The issue is tied t...

CVE-2015-4396

Multiple cross-site request forgery CSRF vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that 1 create, 2 delete, or 3 set priorities to...

CVE-2015-4360

Cross-site request forgery CSRF vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete role-rules via unspecified vectors...

CVE-2015-4393

The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename...

CVE-2015-4379

CVE-2015-4379 affects the Drupal Webform Multiple File Upload module (versions 6.x-1.x prior to 6.x-1.3 and 7.x-1.x prior to 7.x-1.3). The underlying issue is a CSRF vulnerability that allows remote attackers to hijack the authentication of certain users to perform file-deletion actions via unspe...

CVE-2015-4371

Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter...