CVE-2015-5495

The CVE concerns the Drupal Mobile sliding menu module (7.x-2.x) prior to 7.x-2.1. It describes a cross-site scripting (XSS) vulnerability that can be exploited by remote authenticated users who have the 'administer menu' permission to inject arbitrary web script or HTML via unspecified vectors. ...

CVE-2015-5501

The Hostmaster Aegir module 6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2 for Drupal allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment...

CVE-2015-5500

Cross-site scripting XSS vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5514

The CVE-2015-5514 issue affects the Drupal Migrate module (7.x-2.x) prior to 7.x-2.8, specifically when the migrate_ui submodule is enabled. The root cause is insufficient sanitization of destination field labels, enabling user-assisted remote attackers to inject arbitrary web script or HTML. Pra...

CVE-2015-5497

Cross-site scripting XSS vulnerability in the Web Links module 6.x-2.x before 6.x-2.6 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5512

The CVE-2015-5512 entry concerns the Drupal contributed module “me aliases.” The vulnerability affects me aliases 6.x-2.x prior to 6.x-2.10 and 7.x-1.x prior to 7.x-1.2, where the Views “me” user argument handler can be manipulated by substituting a user ID with the literal string “me” in a URL, ...

CVE-2015-5506

The Apache Solr Real-Time module 7.x-1.x before 7.x-1.2 for Drupal does not check the status of an entity when indexing, which allows remote attackers to obtain information about unpublished content via a search...

CVE-2015-5503

Open redirect vulnerability in the Chamilo integration module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters...

CVE-2015-5498

The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview admin/shipwire/shipments, which allows remote attackers to obtain sensitive information via a request to the page...

CVE-2015-5504

CVE-2015-5504 describes an SQL injection in the Novalnet Payment Module Ubercart for Drupal. The vulnerability stems from failing to sanitize a database query via user-controlled input, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected products: Novalne...

CVE-2015-5492

CVE-2015-5492 : A cross-site scripting (XSS) vulnerability was reported in the Drupal Video Consultation module, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected are all versions of the Video Consultation module (Drupal core not affected). The iss...

CVE-2015-5501

The CVE covers Drupal’s Hostmaster (Aegir) module (6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2). The underlying issue allows remote attackers to execute arbitrary PHP code by placing a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site envi...

CVE-2015-5490

The CVE-2015-5490 vulnerability affects the Drupal Views module (7.x-3.x) specifically versions 7.x-3.5 through 7.x-3.10. The root cause is that _views_fetch_data in includes/cache.inc does not rebuild the full cache when the static cache is non-empty, allowing remote attackers to bypass configur...

CVE-2015-5511

The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login...

CVE-2015-5511

The vulnerability CVE-2015-5511 affects the HybridAuth Social Login module for Drupal 7.x-2.x, specifically versions prior to 7.x-2.13. The issue allows remote attackers to bypass the site’s “administrator only” user registration configuration and create accounts via social login. The root cause ...

CVE-2015-5499

The Drupal Navigate module has insufficient permission checks, allowing remote authenticated users to modify custom widgets and create widget records by exploiting the navigate view permission. CVSSv2 base score 4.0 (Medium). No remediation/version details are provided in the supplied documents.

CVE-2015-5515

The CVE-2015-5515 issue affects the Drupal contributed module Views Bulk Operations (VBO) on versions 6.x-1.x and 7.x-3.x prior to 7.x-3.3. The vulnerability arises when the bulk operation for changing Roles is enabled and a user with access to a user listing view (with VBO enabled) can remotely ...

CVE-2015-5504

SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5496

The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via unspecified vectors...

CVE-2015-5512

The me aliases module 6.x-2.x before 6.x-2.10 and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to access Views using the "me" user argument handler by substituting "me" for a user id in a URL...