CVE-2015-4346

The CVE-2015-4346 entry describes a Cross-site scripting (XSS) vulnerability in Drupal’s SMS Framework module (6.x-1.x) prior to 6.x-1.1 when the Send to phone submodule is enabled. The root cause is insufficient sanitization of user-supplied text in message previews, allowing remote attackers to...

CVE-2015-4356

CVE-2015-4356 affects the Drupal Webform module (7.x-4.x) before 7.x-4.4. The vulnerability is an XSS in the view-based webform results table, exploitable by remote authenticated users with certain permissions to inject arbitrary script/HTML via a webform. The root cause is insufficient escaping ...

CVE-2015-4387

The CVE-2015-4387 vulnerability affects the Drupal Password Policy module (6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11). The root cause is inadequate sanitization in certain administration pages when a policy uses the username constraint, allowing a crafted username imported from an exter...

CVE-2015-4363

CVE-2015-4363 is an open redirect vulnerability in the Finder module for Drupal, exploitable via the function finder_form_goto which allows phishing by redirecting users to arbitrary URLs. Affected are Finder 6.x-1.x (Drupal 6) and Finder module 7.x-x.x prior to 7.x-2.1 (Drupal 7). The Drupal SA-...

CVE-2015-4348

CVE-2015-4348 affects the Drupal Spider Contacts contributed module. The vulnerability is an SQL injection in the module that allows remote authenticated users possessing the "access Spider Contacts category administration" permission to execute arbitrary SQL via unspecified vectors. Root cause d...

CVE-2015-4379

Cross-site request forgery CSRF vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors...

CVE-2015-4345

The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages for authenticated requests, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2015-4394

The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the fieldaccess restriction and obtain sensitive private field information via unspecified vectors...

CVE-2015-4385

Cross-site scripting XSS vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "Administer image styles" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4365

CVE-2015-4365 affects the Drupal contributed module Taxonomy Accordion . The underlying issue is insufficient sanitization of user-submitted text in taxonomy term-related pages, enabling a Cross-Site Scripting (XSS) vulnerability. The advisory indicates that remote authenticated users with certai...

CVE-2015-4372

The Drupal Image Title module (7.x-1.x, prior to 7.x-1.1) contains a cross-site scripting (XSS) vulnerability that allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. The underlying issue is insufficient sanitization of user-s...

CVE-2015-4377

Cross-site scripting XSS vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors...

CVE-2015-4361

Cross-site request forgery CSRF vulnerability in the Registration codes module before 6.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete registration codes via unspecified vectors...

CVE-2015-4362

Cross-site request forgery CSRF vulnerability in trackingcode.admin.inc in the Tracking Code module 7.x-1.x before 7.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that disable tracking codes via unspecified vectors...

CVE-2015-4377

CVE-2015-4377 describes a Cross-site scripting (XSS) vulnerability in the Drupal Petition module (6.x-1.x) prior to 6.x-1.3. The issue affects the module’s administration pages and can be triggered by remote authenticated users who have the create petition permission, allowing injection of arbitr...

CVE-2015-4378

CVE-2015-4378 affects the Drupal Crumbs module (7.x-2.x) prior to 7.x-2.3. The vulnerability is a Cross-site scripting (XSS) flaw caused by insufficient sanitization of the custom breadcrumb separator, allowing remote authenticated users with the 'Administer Crumbs' permission to inject arbitrary...

CVE-2015-4352

The CVE-2015-4352 entry concerns the Drupal Spider Video Player module. Multiple sources confirm a CSRF vulnerability that can cause an administrator’s authenticated session to be used to delete videos via specially crafted requests (vectors not specified). Impact is limited to admin actions like...

CVE-2015-4389

The Open Graph Importer ogtagimporter 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import ogtagimporter" permission...

CVE-2015-4397

Cross-site request forgery CSRF vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors...

CVE-2015-4391

Cross-site request forgery CSRF vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors...