PT-2015-6569

Name of the Vulnerable Software and Affected Versions Drupal Password Policy module versions 6.x-1.x before 6.x-1.11 Drupal Password Policy module versions 7.x-1.x before 7.x-1.11 Description A cross-site scripting XSS issue exists in the administration pages of the Password Policy module for...

PT-2015-6568

Name of the Vulnerable Software and Affected Versions EntityBulkDelete module versions 7.x-1.0 Description The issue affects administration pages in the EntityBulkDelete module, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved through unknown vectors involvin...

PT-2015-6567

Name of the Vulnerable Software and Affected Versions Imagefield Info module versions 7.x-1.x before 7.x-1.2 Description A cross-site scripting XSS issue exists in the administration pages of the Imagefield Info module, allowing remote authenticated users with the "Administer image styles"...

CVE-2015-3390

Cross-site scripting XSS vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3390

Cross-site scripting XSS vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3390

CVE-2015-3390 corresponds to an XSS vulnerability in the Drupal module Facebook Album Fetcher . The issue arises from printing fields without proper sanitization, allowing remote authenticated users with the "access administration pages" permission to inject arbitrary script/HTML via unspecified ...

CVE-2015-3390: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the "access administration pages" permission to inject arbitrary web script or HTML via unspecified vectors...

Imagefield Info - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-088

Imagefield Info module enables you to view image field paths so you can easily use them with a WYSIWYG editor. The module doesn't sufficiently sanitize user supplied text in some administration pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fa...

Cross site scripting

Cross-site scripting XSS vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors...

PT-2015-5595

Name of the Vulnerable Software and Affected Versions Drupal Term Queue module versions prior to 6.x-1.1 Description A cross-site scripting XSS issue exists in the administration pages of the Term Queue module, allowing remote attackers to inject arbitrary web script or HTML. This can be achieved...

CVE-2014-6303

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 do not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service resource consumption via a crafted XML document containing a large number of nested entity references, a...

PT-2015-3847

Name of the Vulnerable Software and Affected Versions PNMsoft Sequence Kinetics versions prior to 7.7 Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-6302: Undefined Security Weakness

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-6303: Undefined Security Weakness

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 do not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service resource consumption via a crafted XML document containing a large number of nested entity references, a...

SA-CONTRIB-2015-038 - Facebook Album Fetcher - Cross Site Scripting (XSS) - Unsupported

Facebook Album Fetcher module allows you to fetch Facebook albums from a Facebook account. The module incorrectly prints fields without proper sanitization thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Authentication flaw

The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission...

CVE-2014-9023: Undefined Security Weakness

The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission...

CVE-2014-8734: Undefined Security Weakness

The Organic Groups Menu aka OG Menu module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to change module settings via unspecified vectors...

Oracle Fusion Middleware HTTP Server (July 2012 CPU)

According to its banner, the version of Oracle Fusion Middleware HTTP Server installed on the remote host is affected by an unspecified flaw in the User Administration Pages of the Enterprise Manager for Fusion Middleware component. A remote attacker can exploit this to impact the host's integrit...

SA-CONTRIB-2014-093 - Twilio - Information Disclosure

This module enables you to easily add SMS and VOIP functionality to your website by leveraging the Twilio cloud Voip and SMS service. The module doesn't expose its own permissions for administration including viewing and editing the Twilio authentication tokens. It relies only on "access...