CVE-2015-6659

Removed by vendor...

CVE-2015-6658

Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...

CVE-2015-6665

CVE-2015-6665 affects Drupal 7.x up to version 7.39 and the Ctools module 6.x up to 6.x-1.14. The XSS flaw resides in the Ajax handler, allowing remote attackers to inject arbitrary scripts/HTML via a whitelisted HTML element (potentially the A tag). Remediation: upgrade to Drupal 7.39 and Ctools...

CVE-2015-6659

Drupal 7.x contains a SQL injection vulnerability in the SQL comment filtering system of the Drupal Database API, exploitable before 7.39. Remote attackers can execute arbitrary SQL via an SQL comment. A patch/update to Drupal 7.39 fixes this vulnerability; apply or upgrade to 7.39 or later. If p...

CVE-2015-6658

Removed by vendor...

CVE-2015-6661

Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu...

CVE-2015-6660

The CVE-2015-6660 issue affects Drupal 6.x up to 6.37 and Drupal 7.x up to 7.39, where the Form API does not properly validate the form token. This enables CSRF attacks that can upload files to another user’s account via vectors related to file upload value callbacks. Root cause: insufficient for...

CVE-2015-6665

Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...

CVE-2015-6665

Removed by vendor...

CVE-2015-6661

Removed by vendor...

FreeBSD : drupal -- multiple vulnerabilities (9393213d-489b-11e5-b8c7-d050996490d0)

Drupal development team reports : This security advisory fixes multiple vulnerabilities. See below for a list. Cross-site Scripting - Ajax system - Drupal 7 A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax on a whitelisted HTM...

Drupal Ajax System Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Ajax System, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies,...

Drupal Form API Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. Drupal suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

Drupal SQL Comment Filtering System SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP. A SQL injection vulnerability exists in the Drupal SQL Comment Filtering System, which allows remote attackers to exploit the vulnerability to submit specially crafted SQL queries to manipulate or obtain database data...

Drupal Menu Links Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP. A security vulnerability exists in Drupal Menu Links that allows remote attackers to exploit the vulnerability to submit special requests to obtain sensitive information...

Drupal Ctools Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. ctools is one of the API modules used to improve the development experience. A cross-site scripting vulnerability exists in the Drupal Ctools module, which allows remote attackers to exploit the vulnerability to inject...

Drupal Autocomplete System Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Autocomplete System, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

Drupal MailChimp module cross-site scripting vulnerability (CNVD-2015-05690)

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. MailChimp is one of the third-party mail delivery service provider MailChimp integration module. A cross-site scripting vulnerability exists in the MailChimp Signup submodule of the...

Drupal Camtasia Relay Module Cross-Site Scripting Vulnerability

Drupal is an open source content management framework written in the PHP language. A cross-site scripting vulnerability exists in the Drupal Camtasia Relay Module, which can be exploited by an attacker to execute arbitrary script code in a browser to steal cookie-based authentication credentials...

Drupal Smart Trim module cross-site scripting vulnerability (CNVD-2015-05695)

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Smart Trim is one of the text field formatting modules. A cross-site scripting vulnerability exists in the Drupal Smart Trim module in versions 7.x-1.5 prior to 7.x-1.x. A remote attack...