Drupal Releases Security Updates

Drupal has released updates to address multiple vulnerabilities, one of which could allow a remote attacker to gain access to a system account. Available updates include: Drupal core 6.35 for 6.x users Drupal core 7.35 for 7.x users US-CERT encourages users and administrators to review Drupal's...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2015-001

Access bypass Password reset URLs - Drupal 6 and 7 Password reset URLs can be forged under certain circumstances, allowing an attacker to gain access to another user's account without knowing the account's password. In Drupal 7, this vulnerability is mitigated by the fact that it can only be...

SA-CONTRIB-2015-080 - Profile2 Privacy - Cross Site Scripting (XSS)

Profile2 Privacy module enables you to show or hide parts of a profile2 entity based on pre-configured field sets with a title and description. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is...

SA-CONTRIB-2015-079 - Chaos tool suite (ctools) - Multiple vulnerabilities

This module provides a set of APIs and tools to improve the developer experience. Access bypass in autocomplete Drupal 7 only Among other many other things, CTools provides an autocomplete callback for finding entities by their titles or ID. In CTools version 1.5, additional checks were created t...

SA-CONTRIB-2015-078 - Webform - Cross Site Scripting (XSS)

Webform is the module for making surveys, petitions, contests, personalized contact forms, and the like in Drupal. The module doesn't sufficiently sanitize component names when components are used to determine the e-mail addresses that may be sent upon webform submission. This vulnerability is...

Drupal Ubercart Discount Coupons Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Ubercart Discount Coupons is one of the modules used to set up coupons for the Ubercart store. A cross-site scripting vulnerability exists in the Drupal Ubercart Discount Coupons module...

SA-CONTRIB-2015-076 - Image Title - Cross Site Scripting (XSS)

Image Title module allows you to upload an image and use it as a node title. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must allowed to create/edit...

SA-CONTRIB-2015-075 - Perfecto - Open Redirect

The Perfecto module allows themers accurately calibrate the CSS by floating compositions over the page. The module doesn't sufficiently check user supplied URLs in parameters used for page redirection. An attacker could trick users to visit malicious sites without realizing it. CVE identifiers...

SA-CONTRIB-2015-074 - Site Documentation - Cross Site Scripting (XSS)

Site Documentation module enables you to display detailed configuration information. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a user with...

Drupal Commerce Ogone Module Access Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. commerce Ogone is one of the e-commerce modules that integrates Ogone payment system. An access bypass vulnerability exists in the Drupal Commerce Ogone module. An attacker could use...

Drupal Trick Question module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Trick Question is one of the CAPTCHA type spam defense modules. A cross-site scripting vulnerability exists in the Drupal Trick Question module. The vulnerability is due to the program...

SA-CONTRIB-2015-077 - OG tabs - Cross Site Scripting (XSS)

OG Tabs modules provides a secondary menu with links to nodes of the same OG group. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission t...

Drupal Simple Subscription Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Simple Subscription is one of the subscription modules. A cross-site scripting vulnerability exists in the Drupal Simple Subscription module in versions 6.x-1.1 prior to 6.x-1.x and...

Drupal Campaign Monitor Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Campaign Monitor is one of the modules that integrates with the Campaign Monitor API to enable subscription to Drupal site management lists. A cross-site request forgery vulnerability...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Taxonomy Accordion Module

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Taxonomy Accordion is one of the taxonomy modules. Multiple cross-site scripting vulnerabilities exist in the Drupal Taxonomy Accordion module. The program fails to adequately filter...

Drupal Mover Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Mover is one of the modules used to provide content movement between Drupal sites. A cross-site scripting vulnerability exists in the Drupal Mover module that stems from the program's...

Drupal Tracking Code module cross-site request forgery vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Tracking Code is one of the code tracking modules. A cross-site request forgery vulnerability exists in the Drupal Tracking Code module. A remote attacker can exploit this vulnerability...

Multiple vulnerabilities in Drupal Registration codes module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Registration codes is one of the modules that provides users with a valid registration code when they register a new account on the site. A cross-site scripting vulnerability and a...

Drupal Finder Module Open Redirect Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Finder is one of the search modules. An open redirection vulnerability exists in the Drupal Finder module, which stems from the program's failure to adequately filter user-submitted...

CVE-2015-2215

Open redirect vulnerability in the Services single sign-on server helper servicesssoserverhelper module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters...