Activity for Drupal Cross-Site Request Forgery Vulnerability

Drupal is an open source content management system developed by the Drupal community using the PHP language.Activity is one of the Activity modules. A cross-site request forgery vulnerability exists in Activity for Drupal versions 6.x-1.x, which can be exploited by an attacker to send unintended...

CVE-2011-3373

Drupal Views Builk Operations VBO module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-sit...

Cross site scripting

Drupal Views Builk Operations VBO module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-sit...

CVE-2011-3373

Drupal Views Builk Operations VBO module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the "Modify node taxonomy terms" action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-sit...

CVE-2011-3373

The CVE-2011-3373 entry affects the Drupal module Views Bulk Operations (VBO) for Drupal 6.x, specifically versions 6.x-1.0 through 6.x-1.10 . The vulnerability stems from improper escaping of help text in the vocabulary when user tagging is enabled and the action “Modify node taxonomy terms” is ...

Drupal Core file_create_filename Stored Cross-Site Scripting (CVE-2019-6341)

A stored cross-site scripting vulnerability exists in the File module of Drupal Core. The vulnerability is due to improper handling of the filename parameter provided for file uploads to the File module. Successful exploitation could result in the execution of arbitrary script code...

CVE-2012-2079

A cross-site request forgery CSRF vulnerability in the Activity module 6.x-1.x for Drupal...

Cross site request forgery (csrf)

A cross-site request forgery CSRF vulnerability in the Activity module 6.x-1.x for Drupal...

CVE-2012-1637

Cross-site scripting vulnerability XSS in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal...

CVE-2012-2078

Cross-site scripting XSS vulnerability in the Activity module 6.x-1.x for Drupal...

Cross site scripting

Cross-site scripting XSS vulnerability in the Activity module 6.x-1.x for Drupal...

Cross site scripting

Cross-site scripting vulnerability XSS in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal...

CVE-2012-2079

A cross-site request forgery CSRF vulnerability in the Activity module 6.x-1.x for Drupal...

CVE-2012-2079

The CVE-2012-2079 CSRF vulnerability affects the Drupal Activity module (6.x-1.x). The 6.x-1.x branch does not filter output correctly and does not confirm user intent when removing an activity, enabling unauthorized state-changing requests to the server. Impact details in public advisories descr...

CVE-2012-2078

Activity module 6.x-1.x (Drupal) is affected by a cross-site scripting (XSS) vulnerability due to output not being properly filtered, and an associated issue where removing an activity could trigger a cross-site request forgery (CSRF). Exploitation requires a user with the permissions to access a...

CVE-2012-2078

Cross-site scripting XSS vulnerability in the Activity module 6.x-1.x for Drupal...

CVE-2012-1637

Cross-site scripting vulnerability XSS in the Quick Tabs module 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7.x-3.3 for Drupal...

CVE-2012-1637

The CVE-2012-1637 vulnerability affects the Drupal Quick Tabs contributed module, not Drupal core. It is a Cross-Site Scripting (XSS) issue caused by insufficient filtering of user-supplied text. Affected versions are Quicktabs 6.x-2.x before 6.x-2.1, 6.x-3.x before 6.x-3.1, and 7.x-3.x before 7....

Unspecified Vulnerability in Drupal

Drupal is an open source content management system developed by the Drupal community using the PHP language. A security vulnerability exists in version 7.x prior to Drupal 7.5, which can be exploited by attackers to download files attached to comments...

CVE-2011-2726

An access bypass issue was found in Drupal 7.x before version 7.5. If a Drupal site has the ability to attach File upload fields to any entity type in the system or has the ability to point individual File upload fields to the private file directory in comments, and the parent node is denied...