CVE-2015-4383

The CVE-2015-4383 issue affects the Drupal Decisions module. The vulnerability is a Cross-Site Request Forgery (CSRF) flaw in Decisions that allows an attacker to cause an authenticated user to remove individual voters via crafted requests (unspecified vectors). Root cause: insufficient CSRF prot...

CVE-2015-4360

CVE-2015-4360 is a CSRF vulnerability in the Drupal contributed module Registration codes affecting 6.x-1.x before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2. The underlying issue allows remote attackers to hijack administrator authentication for requests that delete role-rules (...

CVE-2015-4379

CVE-2015-4379 affects the Drupal Webform Multiple File Upload module (versions 6.x-1.x prior to 6.x-1.3 and 7.x-1.x prior to 7.x-1.3). The underlying issue is a CSRF vulnerability that allows remote attackers to hijack the authentication of certain users to perform file-deletion actions via unspe...

CVE-2015-4387

The CVE-2015-4387 vulnerability affects the Drupal Password Policy module (6.x-1.x before 6.x-1.11 and 7.x-1.x before 7.x-1.11). The root cause is inadequate sanitization in certain administration pages when a policy uses the username constraint, allowing a crafted username imported from an exter...

CVE-2015-4396

CVE-2015-4396 affects Drupal Keyword Research module (6.x-1.x) prior to 6.x-1.2. Root cause: CSRF vulnerabilities allow remote attackers to hijack the authentication of users with the kwak research admin site keywords permission, enabling actions that create, delete, or set priorities on keywords...

CVE-2015-4346

The CVE-2015-4346 entry describes a Cross-site scripting (XSS) vulnerability in Drupal’s SMS Framework module (6.x-1.x) prior to 6.x-1.1 when the Send to phone submodule is enabled. The root cause is insufficient sanitization of user-supplied text in message previews, allowing remote attackers to...

CVE-2015-4350

The CVE-2015-4350 entry concerns Drupal’s Spider Catalog contributed module, which has CSRF vulnerabilities. The root cause is insufficient CSRF protection on certain URLs, allowing remote attackers to trigger administrator actions that delete products, ratings, or categories. The issue is tied t...

CVE-2015-4396

Multiple cross-site request forgery CSRF vulnerabilities in the Keyword Research module 6.x-1.x before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of users with the "kwresearch admin site keywords" permission for requests that 1 create, 2 delete, or 3 set priorities to...

CVE-2015-4353

The CVE-2015-4353 entry concerns Drupal’s Custom Sitemap contributed module, which is vulnerable to Cross-Site Request Forgery (CSRF). The issue allows an attacker to induce an administrator’s browser to perform actions that delete sitemaps, effectively hijacking admin actions via CSRF. Affected ...

CVE-2015-4369

The CVE-2015-4369 entry relates to a Cross‑Site Scripting (XSS) vulnerability in the Drupal Trick Question module. Affected software: Trick Question module for Drupal 6.x (versions prior to 6.x-1.5) and Drupal 7.x (prior to 7.x-1.5). Root cause: the module does not sufficiently sanitize user‑subm...

CVE-2015-4345

CVE-2015-4345 affects Drupal's RESTful Web Services RESTWS module (Drupal 7.x). The vulnerability is in the Basic Auth submodule: RESTWS 7.x-1.x versions before 7.x-1.5 and 7.x-2.x before 7.x-2.3 cache pages for authenticated requests, which can lead to information disclosure of potentially sensi...

CVE-2015-4375

The CVE-2015-4375 vulnerability affects the Chaos tool suite (ctools) module for Drupal (7.x-1.x prior to 7.x-1.7 and 6.x-1.x prior to 6.x-1.12). It enables remote attackers to obtain sensitive node titles via two attack paths: (1) an autocomplete search on custom entities without an access query...

CVE-2015-4356

CVE-2015-4356 affects the Drupal Webform module (7.x-4.x) before 7.x-4.4. The vulnerability is an XSS in the view-based webform results table, exploitable by remote authenticated users with certain permissions to inject arbitrary script/HTML via a webform. The root cause is insufficient escaping ...

CVE-2015-4392

Cross-site scripting XSS vulnerability in the Display Suite module 7.x-2.7 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to field display settings...

CVE-2015-4360

Cross-site request forgery CSRF vulnerability in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete role-rules via unspecified vectors...

CVE-2015-4384

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4358

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4388

CVE-2015-4388 affects Drupal’s contributed Current Search Links module (7.x-1.x) before 7.x-1.1. The vulnerability arises when the option "Append the keywords passed by the user to the list" is disabled, leaving the module unable to adequately sanitize the user’s search query. This allows remote ...

CVE-2015-4365

Cross-site scripting XSS vulnerability in the Taxonomy Accordion module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...

CVE-2015-4393

The resource/endpoint for uploading files in the Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote authenticated users with the "Save file information" permission to execute arbitrary code via a crafted filename...