14785 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the OPAC module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims for requests that remove a mapping via unknown vectors...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 deploy or 2 delete an .htaccess file via unspecified vectors...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Shibboleth Authentication module before 6.x-4.1 and 7.x-4.x before 7.x-4.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete user role matching rules via unspecified vectors...
Open redirect
Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for 1 hidden form elements or 2 status messages via unspecifi...
Open redirect
Open redirect vulnerability in the Ubercart Currency Conversion module before 6.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination query parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plugin is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a node title...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...
Sql injection
SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database."...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors...
CVE-2015-3347
The CVE-2015-3347 entry concerns the Cloudwords for Multilingual Drupal module for Drupal 7.x before 7.x-2.3, where a Cross-Site Request Forgery (CSRF) vulnerability could allow remote attackers to hijack a victim’s authenticated session via an unspecified menu callback. Public references confirm...
CVE-2015-3353
CVE-2015-3353: XSS in Drupal Field Display Label module (7.x) prior to 7.x-1.3. Root cause: inadequate sanitization of the alternate field label in content types settings, allowing remote authenticated users to inject arbitrary script/HTML. Affected: Drupal 7.x-1.x before 7.x-1.3 (Field Display L...
CVE-2015-3342
The CVE-2015-3342 vulnerability affects the Ubercart Currency Conversion module for Drupal (versions 6.x prior to 6.x-1.2). The issue is an open redirect: user-supplied input in the destination query parameter is not properly validated, enabling remote attackers to redirect users to arbitrary sit...
CVE-2015-3361
The CVE-2015-3361 issue affects the Drupal Linkit module for Drupal 7.x (versions before 7.x-2.7 and 7.x-3.x before 7.x-3.3) when the node search plugin is enabled. It arises from insufficient sanitization of node titles in the search results list, allowing remote authenticated users to inject ar...
CVE-2015-3345
SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database."...
CVE-2015-3350
Cross-site request forgery CSRF vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors...
CVE-2015-3356
Multiple cross-site request forgery CSRF vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that 1 enable or 2 disable modules or 3 change variables via unspecified vectors...
CVE-2015-3364
The CVE-2015-3364 entry concerns the Drupal Content Analysis module (6.x-1.x) prior to 6.x-1.7. An XSS vulnerability arises from insufficient sanitization of input in log messages, allowing remote attackers to inject arbitrary script/HTML. Public disclosures and advisories confirm affected versio...
CVE-2015-3362
CVE-2015-3362 affects Drupal’s Video module (7.x-2.x) prior to 7.x-2.11. The vulnerability arises from insufficient sanitization of node titles when using the video WYSIWYG plugin, enabling XSS by remote authenticated users. Affected versions are Video 7.x-2.x from 7.x-2.2-beta1 through 7.x-2.10....
CVE-2015-3366
CVE-2015-3366 describes a CSRF vulnerability in the Drupal Alfresco module prior to 6.x-1.3. Affected component: Alfresco module (Drupal integration). Root cause: CSRF protection gaps allow remote attackers to perform actions on behalf of authenticated users, potentially deleting an Alfresco node...