Web Links - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-110

The Web Links module provides a comprehensive way to manage url links to other websites. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permissio...

Drupal Keyword Research Module Cross-Site Request Forgery Vulnerability

Drupal is an open source content management system.Keyword Research is a module that provides keywords for searches. A cross-site request forgery vulnerability exists in the Drupal Keyword Research module that allows remote attackers to construct malicious URIs, trick users into parsing them, and...

Drupal Linear Case Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Linear Case, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

Drupal Node Template Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language.Node Template is one of the modules that uses the structure and data of nodes as a template. A cross-site scripting vulnerability exists in the Drupal Node Template module, which allows remote attackers to explo...

Drupal Crumbs Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Crumbs, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information ...

Drupal Webform Multiple File Upload Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal Webform Multiple File Upload, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform...

Shipwire - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-111

The Shipwire API module handles communication with the Shipwire shipping service. The Shipwire module doesn't check view permission for the shipments overview page when installed admin/shipwire/shipments. Limited non-public information is displayed on the page. CVE identifiers issued CVE-2015-549...

Drupal Imagefield Info Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Imagefield Info, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information...

Drupal Invoice Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal Invoice, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

Drupal Display Suite Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Display Suite is one of the content display management modules. A cross-site scripting vulnerability exists in the Drupal Display Suite module, which stems from the program's failure to...

Drupal Decisions Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal Decisions, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

pass2pdf - Critical - Information Disclosure - Unsupported - SA-CONTRIB-2015-109

This module allows you to let users set a password upon registering, and have the password emailed to the user in a PDF file. The module has an Information Disclosure vulnerability. The generated PDF files are not protected. The user passwords are exposed to anonymous users. CVE identifiers issue...

Drupal Services Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. An access bypass vulnerability exists in the Drupal Services module 7.x-3.11...

Drupal Petition Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Petition, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

[ MDVSA-2015:181 ] drupal

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2015:181 http://www.mandriva.com/en/support/security/ Package : drupal Date : March 30, 2015 Affected: Business Server 1.0 Problem Description: Updated drupal packages fix security vulnerabilities: An information...

Drupal View Module Access Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP. An access bypass vulnerability exists in the Drupal view module. This vulnerability allows attackers to bypass certain security restrictions and perform unauthorized operations...

Dynamic display block - Less Critical - Access bypass - SA-CONTRIB-2015-104

This module enables you to showcase featured content at a prominent place on the front page of the site in an attractive way. The module doesn't sufficiently protect access to content a user has no access to. In certain scenarios a user with the "administer ddblock" permission can see titles of...

Webform Matrix Component - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-107

The Webform Matrix Component module is an extension of the Webform module that adds Matrix and Table components. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must ha...

Entityform Block - Moderately Critical - Access Bypass - SA-CONTRIB-2015-106

This module enables you to display an entityform as a block. The module doesn't sufficiently check permissions on the entityform under scenarios where the form is locked to a certain role. CVE identifiers issued CVE-2015-5493 Versions affected Entityform Block 7.x-1.x versions prior to 7.x-1.3...

Mobile sliding menu - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-108

The mobile sliding menu module integrates the mmenu jQuery plugin for creating slick, app look-alike sliding menus for your mobile website. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fa...