14785 matches found
CVE-2015-3367
CVE-2015-3367 corresponds to CSRF vulnerabilities in the Drupal Patterns module. Affected: Patterns 7.x-2.x prior to 7.x-2.2. Impact: remote attackers could leverage CSRF to cause administrators to restore, publish, or unpublish patterns. Root cause: missing or weak CSRF protection in the Pattern...
CVE-2015-3375
The CVE-2015-3375 entry concerns the Drupal Shibboleth Authentication module. A CSRF vulnerability allows remote attackers to hijack administrator authentication for requests that delete user role matching rules. Affected: Shibboleth Authentication module for Drupal 6.x-4.x before 6.x-4.1 and 7.x...
CVE-2015-3358
Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...
CVE-2015-3347
Cross-site request forgery CSRF vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims via an unknown menu callback...
CVE-2015-3344
Cross-site scripting XSS vulnerability in the Course module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...
CVE-2015-3365
CVE-2015-3365 is a Drupal XSS vulnerability in the nodeauthor module. The issue arises from insufficient sanitization of Profile2 fields inside a provided block, allowing remote authenticated users to inject arbitrary web script or HTML. Affected products include the nodeauthor module (all versio...
CVE-2015-3345
The CVE-2015-3345 issue affects the Drupal PHPlist Integration Module (6.x-1.x) before 6.x-1.7. The vulnerability is an SQL injection that could allow remote administrators to execute arbitrary SQL commands via the phpList database. Root cause: the module’s integration points expose the Drupal/da...
CVE-2015-3370
CVE-2015-3370 — Drupal Node Invite CSRF : A CSRF in the Drupal Node Invite module (6.x prior to 6.x-2.5) allows remote attackers to hijack the authentication of users who have the "node_invite_can_manage_invite" permission for requests that re-enable node invitations via unspecified vectors. Affe...
CVE-2015-3354
Cross-site request forgery CSRF vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete wishlist purchase intentions via unspecified vectors...
CVE-2015-3350
The CVE-2015-3350 issue affects the Drupal Todo Filter module, not Drupal core. Affected: Todo Filter 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1. Root cause: cross-site request forgery (CSRF) that lets remote attackers hijack a user’s authenticated session to toggle a task via unspecified ...
CVE-2015-3361
Cross-site scripting XSS vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plugin is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a node title...
CVE-2015-3348
Cross-site scripting XSS vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...
CVE-2015-3368
CVE-2015-3368 affects Drupal Classified Ads module (versions prior to 6.x-3.1 and 7.x-3.x prior to 7.x-3.1). The vulnerability is a cross-site scripting (XSS) in the administration UI where remote authenticated users with the administer taxonomy permission can inject arbitrary script/HTML via the...
CVE-2015-3355
The CVE-2015-3355 entry concerns CSRF in the Drupal Batch Jobs module (7.x, pre-1.2). Exploitation could allow remote attackers to hijack a user’s session to perform actions such as deleting a batch job or executing a task via crafted requests, as documented by multiple sources including DRUPAL-S...
CVE-2015-3352
The Jammer module for Drupal is affected by CVE-2015-3352. A CSRF weakness in Jammer 6.x-1.x (before 6.x-1.8) and 7.x-1.x (before 7.x-1.4) lets an attacker cause an administrator to perform actions that delete settings for (1) hidden form elements or (2) status messages via the report administrat...
CVE-2015-3372
The Drupal Node Invite module (6.x) is vulnerable prior to 6.x-2.5: an XSS flaw allows remote authenticated users to inject script/HTML via a node title. Additional issues include CSRF exposure and an open redirect vulnerability. Affected versions: Node Invite 6.x-2.x before 6.x-2.5; Drupal core ...
CVE-2015-3351
CVE-2015-3351 affects the Drupal Log Watcher module (6.x-1.x) before 6.x-1.2. The issue is a CSRF vulnerability in the report administration links that can allow an attacker to trigger actions (enable, disable, or delete a report) on behalf of an authenticated administrator, effectively hijacking...
CVE-2015-3352
Multiple cross-site request forgery CSRF vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for 1 hidden form elements or 2 status messages via unspecifi...
CVE-2015-3353
Cross-site scripting XSS vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings...