CVE-2015-3385

CVE-2015-3385 affects Drupal’s Taxonomy Path module for 7.x versions prior to 7.x-1.2. The vulnerability is a reflected XSS due to insufficient sanitization in the “Link to path” field formatter, allowing remote authenticated users to inject arbitrary script/html. The public advisories corroborat...

CVE-2015-3389

Cross-site scripting XSS vulnerability in the Download counts report page in the Public Download Count module pubdlcnt 7.x-1.x-dev and earlier for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3386

CVE-2015-3386 is an XSS vulnerability in the Node Access Product module for Drupal. It allows remote authenticated users to inject arbitrary script/HTML via a node title. Affected: all versions of the Node Access Product module. Root cause: insufficient sanitization of node titles. Impact: potent...

CVE-2015-3393

Open redirect vulnerability in the Commerce WeDeal module before 7.x-1.3 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via an unspecified parameter...

CVE-2015-3392

CVE-2015-3392 (Drupal) affects the Ajax Timeline module for Drupal 7.x. The root cause is insufficient escaping of node titles when rendering the timeline, enabling a Cross-site Scripting (XSS) vulnerability. It allows remote authenticated users to inject arbitrary web script or HTML via a node t...

CVE-2015-3389

Summary: CVE-2015-3389 affects the Drupal Public Download Count module (pubdlcnt). The vulnerability is an XSS in the Download counts report page in 7.x-1.x-dev and earlier due to insufficient sanitization, allowing remote authenticated users to inject arbitrary web script or HTML via unspecified...

CVE-2015-3384

Cross-site scripting XSS vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3380

CVE-2015-3380 concerns the Drupal Feature Set contributed module. A CSRF flaw allows remote attackers to cause an administrator to enable or disable modules via crafted requests, compromising admin actions. Affected: Feature Set module for Drupal (all versions prior to fixed release). Root cause:...

CVE-2015-3386

Cross-site scripting XSS vulnerability in the Node Access Product module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3392

Cross-site scripting XSS vulnerability in the Ajax Timeline module before 7.x-1.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3381

Cross-site scripting XSS vulnerability in the Node basket module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3393

CVE-2015-3393 relates to the Commerce WeDeal Drupal module (7.x) prior to 7.x-1.3. The vulnerability is an open redirect: an attacker can redirect users to arbitrary sites via an unspecified parameter, enabling phishing-like redirects. Affected versions: Commerce WeDeal 7.x-1.x before 7.x-1.3. Im...

CVE-2015-3384

CVE-2015-3384 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Commerce Balanced Payments module, specifically affecting the Bank Account Listing Page. The root cause is insufficient sanitization of user-supplied text in that page, enabling remote authenticated users to inject arbitrar...

CVE-2015-3382

Drupal Node basket module contains CSRF vulnerabilities that can allow an attacker to hijack user sessions to add or remove nodes from a basket. Affected across versions prior to the fixes noted in the Drupal advisory; vectors are not detailed in the provided documents. Mitigation referenced: upd...

CVE-2015-3388

CVE-2015-3388 affects Drupal’s Commerce Balanced Payments module. A CSRF flaw allows an attacker to hijack a user’s session to trigger requests that delete the user’s configured bank accounts via unspecified vectors. Public advisories indicate CSRF (and related XSS) in Commerce Balanced Payments ...

CVE-2015-3388

Cross-site request forgery CSRF vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors...

CVE-2015-3383

Open redirect vulnerability in the Node basket module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-3390

CVE-2015-3390 corresponds to an XSS vulnerability in the Drupal module Facebook Album Fetcher . The issue arises from printing fields without proper sanitization, allowing remote authenticated users with the "access administration pages" permission to inject arbitrary script/HTML via unspecified ...

CVE-2015-3379

The Views module before 6.x-2.18, 6.x-3.x before 6.x-3.2, and 7.x-3.x before 7.x-3.10 for Drupal does not properly restrict access to the default views configurations, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2015-3381

CVE-2015-3381 (Drupal Node basket module) describes a cross-site scripting (XSS) flaw in the Node basket module for Drupal. The vulnerability permits remote authenticated users to inject arbitrary web script or HTML via unspecified vectors due to insufficient input sanitization. Affected versions...