518 matches found
CVE-2013-6387: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field...
CVE-2013-6388: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS...
CVE-2013-6389
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
CVE-2013-6389
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
Open redirect
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
CVE-2013-6389
Removed by vendor...
CVE-2013-6389
Drupal 7.x Overlay module contains an open redirect vulnerability tracked as CVE-2013-6389, fixed in Drupal 7.24. The issue allows remote attackers to redirect users to arbitrary sites and conduct phishing via unspecified vectors. Affected: Drupal 7.x before 7.24 (Overlay module). Impact details ...
CVE-2013-6389: Improper Input Validation
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
Drupal 7.x < 7.24 Multiple Vulnerabilities
The remote web server is running a version of Drupal that is 7.x prior to 7.24. It is, therefore, potentially affected by multiple vulnerabilities : - An error exists related to the HTML form API and validation callbacks as used by third-party modules that could allow an attacker to bypass the...
SA-CONTRIB-2013-096 - Entity reference - Access bypass
By default, with an autoselect or a select widget, a user cannot autocomplete an entity title, nor can they select an entity that they have no access to. This will correctly throw a 'invalid id' error and does not show the title of the entity. However, if a user A that has access to the reference...
SA-CONTRIB-2013-093 - Invitation - Access Bypass
The Invitation module restricts registration to users who have an invite code for running a private beta. The module provides default views that don't check access to views prior to displaying private information like usernames and email addresses. CVE identifiers issued CVE-2013-7063 Versions...
SA-CONTRIB-2013-089 - Node Access Keys - Access Bypass
Node Access Keys helps to grant users temporary view permissions to selected content types on a per user role basis. However, it only implements hooknodeaccess and not hookqueryalter, which means any listing of nodes does not respect the node view access. CVE identifiers issued CVE-2013-4596...
SA-CONTRIB-2013-086 - Monster Menus - Access bypass
Monster Menus includes the ability to protect the visibility of comments for each node based on hierarchical permissions. However, a carefully-crafted URL could be used to bypass these permissions, allowing an anonymous user to view the comments associated with certain nodes. In order for this fl...
CVE-2012-0826
Cross-site request forgery CSRF vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service loss of updates due to rate limit...
Design/Logic Flaw
The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors...
CVE-2012-0827
Drupal 7.x File module vulnerability CVE-2012-0827 (before 7.11) allows remote authenticated users to read arbitrary private files associated with restricted fields when using unspecified field access modules. The issue is an access-control bypass in the File module, corroborated by OpenVAS/VuXML...
CVE-2012-0825
CVE-2012-0825 affects Drupal 6.x up to 6.23 and 7.x up to 7.11, where Attribute Exchange (AX) information is not signed, enabling MITM modification of AX data. Related advisories confirm this CVE in multiple distributions (e.g., Debian DSA-2776-1; MiracleLinux AXSA-2012-98:01). Remediation in aff...
CVE-2012-0826
CVE-2012-0826 is a CSRF vulnerability in Drupal’s Aggregator module affecting Drupal 6.x before 6.23 and 7.x before 7.11. The issue allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and may cause a denial of service via rate-limited updates...
CVE-2012-0826
Cross-site request forgery CSRF vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service loss of updates due to rate limit...