CVE-2015-4363

CVE-2015-4363 is an open redirect vulnerability in the Finder module for Drupal, exploitable via the function finder_form_goto which allows phishing by redirecting users to arbitrary URLs. Affected are Finder 6.x-1.x (Drupal 6) and Finder module 7.x-x.x prior to 7.x-2.1 (Drupal 7). The Drupal SA-...

CVE-2015-4348

CVE-2015-4348 affects the Drupal Spider Contacts contributed module. The vulnerability is an SQL injection in the module that allows remote authenticated users possessing the "access Spider Contacts category administration" permission to execute arbitrary SQL via unspecified vectors. Root cause d...

CVE-2015-4385

The CVE concerns the Drupal Imagefield Info module (7.x-1.x) prior to 7.x-1.2. The issue is an XSS vulnerability in unspecified administration pages caused by inadequate sanitization, allowing remote authenticated users with the Administer image styles permission to inject arbitrary scripts or HT...

CVE-2015-4386

The CVE-2015-4386 entry refers to a Drupal EntityBulkDelete module vulnerability (7.x-1.0) involving multiple XSS flaws in unspecified administration pages. The root cause is insufficient sanitization of user-supplied text in admin interfaces, which could allow remote attackers to inject arbitrar...

CVE-2015-4359

The vulnerability CVE-2015-4359 affects the Drupal Registration codes module. Affected are 6.x-1.x prior to 6.x-1.6, 6.x-2.x prior to 6.x-2.8, and 7.x-1.x prior to 7.x-1.2. The issue is cross-site scripting (XSS) where remote authenticated users with permission to create or edit taxonomy terms or...

CVE-2015-4383

Cross-site request forgery CSRF vulnerability in the Decisions module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that remove individual voters via unspecified vectors...

CVE-2015-4368

The Commerce Ogone module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to complete the checkout for an order without paying via unspecified vectors...

CVE-2015-4386

Multiple cross-site scripting XSS vulnerabilities in unspecified administration pages in the EntityBulkDelete module 7.x-1.0 for Drupal allow remote attackers to inject arbitrary web script or HTML via unknown vectors involving creating or editing 1 comments, 2 taxonomy terms, or 3 nodes...

CVE-2015-4364

Multiple cross-site request forgery CSRF vulnerabilities in includes/campaignmonitorlists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow remote attackers to hijack the authentication of users for requests that 1 enable list subscriptions via a request to...

CVE-2015-4372

Cross-site scripting XSS vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4371

Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter...

CVE-2015-4395

The CVE-2015-4395 affects the HybridAuth Social Login module for Drupal (7.x-2.x) prior to 7.x-2.10. The underlying issue is that when the option “Ask user for a password when registering” is enabled, passwords are stored in plaintext, allowing remote authenticated users with certain permissions ...

CVE-2015-4344

The CVE-2015-4344 entry concerns the Drupal Services Basic Authentication module (Drupal 7.x, versions prior to 7.x-1.3). The root cause is an access-bypass vulnerability related to page caching that could allow remote attackers to bypass intended resource restrictions. Public sources in the conn...

CVE-2015-4344

The Services Basic Authentication module 7.x-1.x through 7.x-1.3 for Drupal allows remote attackers to bypass intended resource restrictions via vectors related to page caching...

CVE-2015-4381

The CVE-2015-4381 entry affects the Drupal Invoice contributed module (versions 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3). The issue is a Cross-Site Scripting (XSS) vulnerability that can be exploited by remote authenticated users who have the "Administer own invoices" permission to inje...

CVE-2015-4366

CVE-2015-4366 affects Drupal’s contributed Mover module (6.x-1.0). The issue stems from insufficient sanitization of user-supplied text in certain pages, enabling Cross-Site Scripting (XSS) by remote authenticated users who have permissions to create/edit nodes. No exploit details provided beyond...

CVE-2015-4359

Multiple cross-site scripting XSS vulnerabilities in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with permission to create or edit taxonomy terms or nodes to inject arbitrary web script or HTML via...

CVE-2015-4378

CVE-2015-4378 affects the Drupal Crumbs module (7.x-2.x) prior to 7.x-2.3. The vulnerability is a Cross-site scripting (XSS) flaw caused by insufficient sanitization of the custom breadcrumb separator, allowing remote authenticated users with the 'Administer Crumbs' permission to inject arbitrary...

CVE-2015-4376

The CVE-2015-4376 entry affects the Drupal Profile2 Privacy module (7.x-1.x) prior to 7.x-1.5. The vulnerability is an XSS flaw due to insufficient sanitization in the module, exploitable by remote authenticated users who have the Administer Profile2 Privacy Levels permission. The vectors are not...

CVE-2015-4372

The Drupal Image Title module (7.x-1.x, prior to 7.x-1.1) contains a cross-site scripting (XSS) vulnerability that allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. The underlying issue is insufficient sanitization of user-s...