CVE-2015-4360

CVE-2015-4360 is a CSRF vulnerability in the Drupal contributed module Registration codes affecting 6.x-1.x before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2. The underlying issue allows remote attackers to hijack administrator authentication for requests that delete role-rules (...

CVE-2015-4384

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4388

CVE-2015-4388 affects Drupal’s contributed Current Search Links module (7.x-1.x) before 7.x-1.1. The vulnerability arises when the option "Append the keywords passed by the user to the list" is disabled, leaving the module unable to adequately sanitize the user’s search query. This allows remote ...

CVE-2015-4365

Cross-site scripting XSS vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4383

Cross-site request forgery CSRF vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that remove individual voters via unspecified vectors...

CVE-2015-4392

Cross-site scripting XSS vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings...

CVE-2015-4368

The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors...

CVE-2015-4345

CVE-2015-4345 affects Drupal's RESTful Web Services RESTWS module (Drupal 7.x). The vulnerability is in the Basic Auth submodule: RESTWS 7.x-1.x versions before 7.x-1.5 and 7.x-2.x before 7.x-2.3 cache pages for authenticated requests, which can lead to information disclosure of potentially sensi...

CVE-2015-4344

The CVE-2015-4344 entry concerns the Drupal Services Basic Authentication module (Drupal 7.x, versions prior to 7.x-1.3). The root cause is an access-bypass vulnerability related to page caching that could allow remote attackers to bypass intended resource restrictions. Public sources in the conn...

CVE-2015-4386

Multiple cross-site scripting XSS vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing 1 comments, 2 taxonomy terms, or 3 nodes...

CVE-2015-4364

Multiple cross-site request forgery CSRF vulnerabilities in includes/campaignmonitorlists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow remote attackers to hijack the authentication of users for requests that 1 enable list subscriptions via a request to...

CVE-2015-4372

Cross-site scripting XSS vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4344

The Services Basic Authentication module 7.x-1.x through 7.x-1.3 for Drupal allows remote attackers to bypass intended resource restrictions via vectors related to page caching...

CVE-2015-4358

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4395

The CVE-2015-4395 affects the HybridAuth Social Login module for Drupal (7.x-2.x) prior to 7.x-2.10. The underlying issue is that when the option “Ask user for a password when registering” is enabled, passwords are stored in plaintext, allowing remote authenticated users with certain permissions ...

CVE-2015-4385

The CVE concerns the Drupal Imagefield Info module (7.x-1.x) prior to 7.x-1.2. The issue is an XSS vulnerability in unspecified administration pages caused by inadequate sanitization, allowing remote authenticated users with the Administer image styles permission to inject arbitrary scripts or HT...

CVE-2015-4369

The CVE-2015-4369 entry relates to a Cross‑Site Scripting (XSS) vulnerability in the Drupal Trick Question module. Affected software: Trick Question module for Drupal 6.x (versions prior to 6.x-1.5) and Drupal 7.x (prior to 7.x-1.5). Root cause: the module does not sufficiently sanitize user‑subm...

CVE-2015-4353

The CVE-2015-4353 entry concerns Drupal’s Custom Sitemap contributed module, which is vulnerable to Cross-Site Request Forgery (CSRF). The issue allows an attacker to induce an administrator’s browser to perform actions that delete sitemaps, effectively hijacking admin actions via CSRF. Affected ...

CVE-2015-4375

The CVE-2015-4375 vulnerability affects the Chaos tool suite (ctools) module for Drupal (7.x-1.x prior to 7.x-1.7 and 6.x-1.x prior to 6.x-1.12). It enables remote attackers to obtain sensitive node titles via two attack paths: (1) an autocomplete search on custom entities without an access query...

CVE-2015-4359

The vulnerability CVE-2015-4359 affects the Drupal Registration codes module. Affected are 6.x-1.x prior to 6.x-1.6, 6.x-2.x prior to 6.x-2.8, and 7.x-1.x prior to 7.x-1.2. The issue is cross-site scripting (XSS) where remote authenticated users with permission to create or edit taxonomy terms or...