CVE-2015-5493

The CVE-2015-5493 entry describes a vulnerability in the Drupal Entityform Block module (7.x-1.x before 7.x-1.3). The root cause is improper permission checks when a form is locked to a role, enabling remote attackers to obtain access to certain entityforms via unspecified vectors. Affected softw...

PT-2015-6943

Name of the Vulnerable Software and Affected Versions Dynamic display block module versions 7.x-1.x before 7.x-1.1 Description The issue allows remote authenticated users to bypass intended access restrictions and read sensitive titles by leveraging the administer ddblock permission...

PT-2015-5395

Name of the Vulnerable Software and Affected Versions Drupal Webform prepopulate block module version prior to 7.x-3.1 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote authenticated users to inject arbitrary web script or HTML. Recommendations For...

CVE-2014-9501

The CVE concerns the Drupal Poll Chart Block module (Drupal 7.x, versions prior to 7.x-1.2). The issue is an XSS vulnerability caused by insufficient sanitization of poll node titles displayed in the poll chart block, allowing remote authenticated users to inject arbitrary script/HTML. Affected p...

CVE-2012-1578

Multiple cross-site request forgery CSRF vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that 1 block a user via a request to the Block module or 2 unblock a user via a...

CVE-2012-1578

Multiple cross-site request forgery CSRF vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that 1 block a user via a request to the Block module or 2 unblock a user via a...

CVE-2012-1578: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that 1 block a user via a request to the Block module or 2 unblock a user via a...

PT-2012-3352

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.17.x through 1.17.2 MediaWiki versions 1.18.x through 1.18.1 Description The issue allows remote attackers to hijack the authentication of users with the block permission for requests that block or unblock a user. This is...

Nuked-Klan SP4 RFI Vulnerability

No description provided by source. ======================================================================================== $ | Title : Nuked-Klan SP4 RFI Vulnerability | | Author : indoushka | | email : [email protected] | | Home : Souk Naamane - 04325 - Oum El Bouaghi - Algeria...

SA-CONTRIB-2009-028 - Feed Block - Cross Site Scripting

The Feed Block module creates a block with one externalsyndicated article for each feed source from selected feed category. Feed block doesn't properly escapes aggregator items allowing users with administer news feeds permission to inject arbitrary code into the site. Such a cross site scripting...