Drupal HybridAuth Social Login Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP.HybridAuth Social Login is one of the modules that uses social network accounts to log in and register with the Drupal system. A security vulnerability exists in the Drupal HybridAuth Social Login module that could be...

Drupal Shibboleth authentication module cross-site scripting vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Shibboleth Authentication is one of the user login and get access to the authentication module . A cross-site scripting vulnerability exists in the Drupal Shibboleth authentication...

Drupal me aliases module security bypass vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability exists in the Drupal me aliases module that allows an attacker to bypass certain security restrictions and perform unauthorized operations...

CVE-2014-9740

Cross-site scripting XSS vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the 1 question and 2...

CVE-2014-9739

Cross-site scripting XSS vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields...

CVE-2014-9738

Multiple cross-site scripting XSS vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 account username, a 2 node title, or a 3 team entity title...

CVE-2014-9737

Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block...

Cross site scripting

Cross-site scripting XSS vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the 1 question and 2...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 account username, a 2 node title, or a 3 team entity title...

Open redirect

Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block...

Cross site scripting

Cross-site scripting XSS vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields...

CVE-2014-9737

Open redirect vulnerability in the Language Switcher Dropdown module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a block...

CVE-2014-9739

CVE-2014-9739 affects the Drupal Node Field module (7.x-2.x) prior to 7.x-2.45. The vulnerability is a cross-site scripting (XSS) flaw that allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields. Root cau...

CVE-2014-9737

Open redirect in Drupal Language Switcher Dropdown module (7.x-1.x) prior to 7.x-1.4. The module does not validate the redirect URL in the block, allowing attackers to redirect users to arbitrary sites and facilitate phishing. Affected: Drupal 7.x-1.x versions before 7.x-1.4. Mitigation: upgrade ...

CVE-2014-9740

Cross-site scripting XSS vulnerability in the Rules Link module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer rules links" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in the 1 question and 2...

CVE-2014-9739

Cross-site scripting XSS vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields...

CVE-2014-9738

The CVE-2014-9738 entry concerns the Drupal contributed Tournament module (7.x-1.x) with XSS in three fields: account username, node title, and team entity title, affecting all 7.x-1.x versions prior to 7.x-1.2. The root cause is cross-site scripting in display of user-provided strings, exploitab...

CVE-2014-9740

CVE-2014-9740 concerns the Drupal contributed module Rules Link (7.x-1.x) , affected up to version 7.x-1.0 before 7.x-1.1 . The vulnerability arises from insufficient sanitization of the question and description strings in a triggering Rules link confirmation form, allowing remote authenticated u...

CVE-2014-9738

Multiple cross-site scripting XSS vulnerabilities in the Tournament module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 account username, a 2 node title, or a 3 team entity title...

[SECURITY] Fedora 21 Update: drupal7-7.38-1.fc21

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...