CVE-2015-4363

Open redirect vulnerability in the finderformgoto function in the Finder module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-4394

The CVE-2015-4394 issue affects the Drupal Services module (7.x-3.x) prior to 7.x-3.12, where an improper field_access check allows remote attackers to disclose private field information. The vulnerability is tied to the Services module’s handling of entity field access, enabling information expo...

CVE-2015-4368

CVE-2015-4368 affects the Drupal Commerce Ogone module (7.x-1.x) prior to 7.x-1.5. The vulnerability allows malicious users to bypass the payment step and complete the checkout without a payment being processed, via unspecified vectors described in the advisory and CVE records. The root cause is ...

CVE-2015-4345

The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages for authenticated requests, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2015-4394

The Services module 7.x-3.x before 7.x-3.12 for Drupal allows remote attackers to bypass the fieldaccess restriction and obtain sensitive private field information via unspecified vectors...

CVE-2015-4365

CVE-2015-4365 affects the Drupal contributed module Taxonomy Accordion . The underlying issue is insufficient sanitization of user-submitted text in taxonomy term-related pages, enabling a Cross-Site Scripting (XSS) vulnerability. The advisory indicates that remote authenticated users with certai...

CVE-2015-4392

CVE-2015-4392 describes an XSS vulnerability in the Drupal Display Suite module for version 7.x-2.7. The issue allows remote authenticated users to inject arbitrary script/HTML via field display settings. The root cause is improper sanitization in Display Suite 7.x-2.7. Mitigation: upgrade to Dis...

CVE-2015-4351

CVE-2015-4351 affects the Drupal Spider Video Player module. Remote authenticated users with the access Spider Video Player administration permission could delete arbitrary files via a crafted URL. The issue stems from insufficient validation of delete requests (and related CSRF protections) in t...

CVE-2015-4352

The CVE-2015-4352 entry concerns the Drupal Spider Video Player module. Multiple sources confirm a CSRF vulnerability that can cause an administrator’s authenticated session to be used to delete videos via specially crafted requests (vectors not specified). Impact is limited to admin actions like...

CVE-2015-4358

The vulnerability CVE-2015-4358 affects Ubercart Discount Coupons module for Drupal 6.x-1.x prior to 6.x-1.8. The issue is an XSS in unspecified administration pages due to insufficient sanitization of user-supplied text, exploitable by remote authenticated users with certain permissions to injec...

CVE-2015-4371

CVE-2015-4371 affects the Drupal Perfecto module (7.x) prior to 7.x-1.2. The vulnerability is an open redirect: an attacker can craft a URL parameter to redirect users to an attacker-controlled site, enabling phishing. Impact: credential/phishing risk for users visiting affected pages. Affected c...

CVE-2015-4378

Cross-site scripting XSS vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator...

CVE-2015-4385

Cross-site scripting XSS vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "Administer image styles" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4389

The Open Graph Importer ogtagimporter 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import ogtagimporter" permission...

CVE-2015-4347

Cross-site scripting XSS vulnerability in the inLinks Integration module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified path arguments...

CVE-2015-4397

Cross-site request forgery CSRF vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors...

CVE-2015-4355

CVE-2015-4355 describes a CSRF vulnerability in the Drupal Watchdog Aggregator module. The flaw allows remote attackers to hijack administrator authentication to perform actions like enabling or disabling monitoring sites via unspecified vectors. The affected component is the Watchdog Aggregator ...

CVE-2015-4391

Cross-site request forgery CSRF vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors...

CVE-2015-4375

The Chaos tool suite ctools module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via 1 an autocomplete search on custom entities without an access query tag or 2 leveraging knowledge of the ID of an entity...

CVE-2015-4391

Summary: The CVE-2015-4391 vulnerability affects the Drupal CiviCRM private report module, specifically 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3. The root cause is CSRF in the private report module that allows remote attackers to hijack a user’s session to delete reports via crafted ...