Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 deploy or 2 delete an .htaccess file via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors...

Open redirect

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

Open redirect

Open redirect vulnerability in the Ubercart Currency Conversion module before 6.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination query parameter...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for 1 hidden form elements or 2 status messages via unspecifi...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the OPAC module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims for requests that remove a mapping via unknown vectors...

Sql injection

SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database."...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Patterns module before 7.x-2.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 restore, 2 publish, or 3 unpublish a pattern via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Shibboleth Authentication module before 6.x-4.1 and 7.x-4.x before 7.x-4.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete user role matching rules via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

CVE-2015-3361

The CVE-2015-3361 issue affects the Drupal Linkit module for Drupal 7.x (versions before 7.x-2.7 and 7.x-3.x before 7.x-3.3) when the node search plugin is enabled. It arises from insufficient sanitization of node titles in the search results list, allowing remote authenticated users to inject ar...

CVE-2015-3362

CVE-2015-3362 affects Drupal’s Video module (7.x-2.x) prior to 7.x-2.11. The vulnerability arises from insufficient sanitization of node titles when using the video WYSIWYG plugin, enabling XSS by remote authenticated users. Affected versions are Video 7.x-2.x from 7.x-2.2-beta1 through 7.x-2.10....

CVE-2015-3349

Multiple cross-site request forgery CSRF vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 deploy or 2 delete an .htaccess file via unspecified vectors...

CVE-2015-3367

Multiple cross-site request forgery CSRF vulnerabilities in the Patterns module before 7.x-2.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 restore, 2 publish, or 3 unpublish a pattern via unspecified vectors...

CVE-2015-3360

CVE-2015-3360 describes a Cross-Site Scripting (XSS) vulnerability in the Drupal contributed Term Merge module for 7.x-1.x prior to 7.x-1.2. The issue arises because user input is not sufficiently filtered under certain conditions, allowing remote authenticated users to inject arbitrary web scrip...

CVE-2015-3342

The CVE-2015-3342 vulnerability affects the Ubercart Currency Conversion module for Drupal (versions 6.x prior to 6.x-1.2). The issue is an open redirect: user-supplied input in the destination query parameter is not properly validated, enabling remote attackers to redirect users to arbitrary sit...

CVE-2015-3373

CVE-2015-3373 affects the Drupal Amazon AWS contributed module prior to version 7.x-1.3. The vulnerability stems from generating an access token using the base URL and AWS access key, enabling remote attackers to guess the token value and trigger creation of backups via a crafted URL. Affected pr...

CVE-2015-3374

CVE-2015-3374 affects the Drupal Corner module. The vulnerability allows remote attackers to hijack administrator sessions by forcing the admin’s browser to perform CSRF requests to enable or disable corners, via unspecified vectors. Affected are Corner module versions prior to a fixed release; D...

CVE-2015-3363

Cross-site request forgery CSRF vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors...

CVE-2015-3354

The CVE-2015-3354 entry concerns the Drupal Wishlist module (versions 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7). The vulnerability is a CSRF flaw that allows remote attackers to hijack the authentication of arbitrary users to perform actions deleting wishlist purchase intentions via unsp...