CVE-2015-4370

CVE-2015-4370 is a XSS in the Drupal Site Documentation module (6.x-1.x) prior to 6.x-1.5. Root cause: insufficient sanitization of user-supplied text on certain pages, exploitable by remote authenticated users with permission to create/edit taxonomy terms. Impact: arbitrary script/HTML injection...

CVE-2015-4354

CVE-2015-4354 is an XSS vulnerability in the Drupal Ubercart Webform Integration module (affected: version 6.x-1.8 and 7.x before 7.x-2.4). The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, due to insufficient inpu...

CVE-2015-4380

CVE-2015-4380 affects Drupal via the Linear Case module (6.x-1.x) prior to 6.x-1.3. Root cause: insufficient sanitization of user-supplied input in certain Linear Case pages. Impact: XSS vulnerability that could be exploited by remote authenticated users with specific permissions to inject arbitr...

CVE-2015-4366

Cross-site scripting XSS vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4352

Cross-site request forgery CSRF vulnerability in the Spider Video Player module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete videos via unspecified vectors...

CVE-2015-4390

Multiple cross-site request forgery CSRF vulnerabilities in the User Import module 6.x-4.x before 6.x-4.4 and 7.x-2.x before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 continue or 2 delete an ongoing import via unspecified vectors...

CVE-2015-4346

Cross-site scripting XSS vulnerability in the SMS Framework module 6.x-1.x before 6.x-1.1 for Drupal, when the "Send to phone" submodule is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to message previews...

CVE-2015-4367

The CVE-2015-4367 issue affects the Drupal Simple Subscription module (6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1). The root cause is inadequate filtering/sanitization of user-submitted content in block content, enabling an authenticated user with the administer blocks permission to inject...

CVE-2015-4355

Cross-site request forgery CSRF vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors...

CVE-2015-4382

CVE-2015-4382 refers to CSRF vulnerabilities in the Drupal Invoice contributed module. Impacted versions are 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3, allowing remote attackers to hijack the authentication of arbitrary users to perform invoices-related actions (create, delete, or alt...

CVE-2015-4390

The vulnerability CVE-2015-4390 affects the Drupal contributed module User Import (versions 6.x-4.x prior to 6.x-4.4 and 7.x-2.x prior to 7.x-2.3). A Cross-Site Request Forgery (CSRF) flaw exists in management URLs that could trick an administrator into continuing or deleting an ongoing import, e...

CVE-2015-4373

Summary: CVE-2015-4373 is a cross-site scripting (XSS) vulnerability in the OG Tabs contributed module for Drupal 7.x, affecting versions prior to 7.x-1.1. Affected component: OG Tabs module (Drupal 7.x). Root cause / vulnerability detail: Module does not sufficiently sanitize user-supplied text ...

CVE-2015-4349

CVE-2015-4349 affects the Drupal Spider Contacts module. It is a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to hijack administrator actions for requests that delete contact categories. The issue is tied to the Spider Contacts module (not Drupal core) and is mitigated...

CVE-2015-4384

CVE-2015-4384 describes a cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module for Drupal. The issue affects Ubercart Webform Checkout Pane 6.x-3.x up to before 6.x-3.10 and 7.x-3.x up to before 7.x-3.11, arising because the module does not sufficiently sanitize u...

CVE-2015-4370

Cross-site scripting XSS vulnerability in the Site Documentation module before 6.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4353

Cross-site request forgery CSRF vulnerability in the Custom Sitemap module for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete sitemaps via unspecified vectors...

CVE-2015-4356

Cross-site scripting XSS vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform...

CVE-2015-4348

SQL injection vulnerability in the Spider Contacts module for Drupal allows remote authenticated users with the "access Spider Contacts category administration" permission to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-4388

Cross-site scripting XSS vulnerability in the Current Search Links module 7.x-1.x before 7.x-1.1 for Drupal, when the "Append the keywords passed by the user to the list" option is disabled, allows remote attackers to inject arbitrary web script or HTML via a crafted search query...

CVE-2015-4357

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...