CVE-2015-5514

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...

CVE-2015-5490

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...

CVE-2015-5492

Cross-site scripting XSS vulnerability in the Video Consultation module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5496

CVE-2015-5496 affects the Drupal pass2pdf module. The vulnerability stems from PDFs generated during user registration not being access-restricted, allowing remote attackers to view password information via unspecified vectors (information disclosure). Affected: all versions of the pass2pdf modul...

CVE-2015-5502

The Storage API module 7.x-1.x before 7.x-1.8 for Drupal does not properly restrict access to Storage API fields attached to entities that are not nodes, which allows remote attackers to have unspecified impact via unknown vectors...

CVE-2015-5510

Open redirect vulnerability in the Content Construction Kit CCK 6.x-2.x before 6.x-2.10 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destinations parameter, related to administration pages...

CVE-2015-5507

Cross-site scripting XSS vulnerability in the Inline Entity Form module 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5494

Cross-site scripting XSS vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5488

CVE-2015-5488 is a cross-site scripting vulnerability in Drupal’s MailChimp module (significant for the MailChimp Signup submodule) in 7.x-3.x before 7.x-3.3. The issue allows remote authenticated users with the administrator privilege (administer mailchimp) to inject arbitrary script/HTML via un...

CVE-2015-5489

The Drupal Smart Trim module (7.x-1.x) is affected by an XSS vulnerability in versions prior to 7.x-1.5 due to insufficient input filtering in the field settings form. This allows remote authenticated users with certain permissions to inject arbitrary script/HTML. Impact is partial integrity loss...

CVE-2015-5510

The CVE-2015-5510 entry concerns the Drupal Content Construction Kit (CCK) module. Affected: CCK 6.x-2.x before 6.x-2.10. Root cause: an open redirect vulnerability via the destinations parameter on certain admin pages, allowing remote attackers to redirect users to arbitrary sites (phishing risk...

CVE-2015-5493

The CVE-2015-5493 entry describes a vulnerability in the Drupal Entityform Block module (7.x-1.x before 7.x-1.3). The root cause is improper permission checks when a form is locked to a role, enabling remote attackers to obtain access to certain entityforms via unspecified vectors. Affected softw...

CVE-2015-5513

Cross-site scripting XSS vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspecified vectors related to a login...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

CVE-2015-5508

CVE-2015-5508 refers to a CSRF vulnerability in The eXtensible Catalog (XC) Drupal Toolkit, specifically the XC NCIP Provider module. The issue arises because certain NCIP-Provider-related URLs aren’t sufficiently CSRF-protected, allowing an attacker to cause users with the administer ncip provid...

CVE-2015-5494

The CVE-2015-5494 entry covers a Cross-Site Scripting (XSS) vulnerability in the Webform Matrix Component module for Drupal (versions 7.x-4.x prior to 7.x-4.13). The issue arises from insufficient sanitization of user-supplied text, allowing remote authenticated users with certain permissions to ...

CVE-2015-5487

The CVE-2015-5487 issue affects the Camtasia Relay module for Drupal (camtasia_relay), specifically versions 6.x-2.x prior to 6.x-3.2 and 7.x-2.x prior to 7.x-1.3. The root cause is insufficient sanitization of user input under the meta access tab, allowing remote authenticated users with the "vi...

CVE-2015-5503

CVE-2015-5503 describes an open redirect in the Drupal Chamilo integration module (7.x-1.x) before 7.x-1.2. The vulnerability enables remote attackers to redirect users to arbitrary websites and conduct phishing via unspecified parameters. Affected component: Chamilo integration module in Drupal ...

CVE-2015-5495

The CVE concerns the Drupal Mobile sliding menu module (7.x-2.x) prior to 7.x-2.1. It describes a cross-site scripting (XSS) vulnerability that can be exploited by remote authenticated users who have the 'administer menu' permission to inject arbitrary web script or HTML via unspecified vectors. ...

CVE-2015-5501

The Hostmaster Aegir module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment...