Open redirect

Open redirect vulnerability in the Services single sign-on server helper servicesssoserverhelper module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters...

CVE-2015-2215

Open redirect vulnerability in the Services single sign-on server helper servicesssoserverhelper module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters...

CVE-2015-2215

The CVE-2015-2215 entry concerns Drupal’s Services single sign-on server helper module. The vulnerability is an open redirect: the module fails to validate some user-supplied URLs in redirect parameters, allowing remote attackers to redirect users to arbitrary sites and facilitate phishing. Affec...

Drupal Global Redirect Module Open Redirect Feature Vulnerability

Drupal is an open source CMS that can be used as a content management platform for various websites. An open redirect functionality vulnerability exists in the Drupal Global Redirect module, which can be exploited to allow an attacker to redirect a user to an arbitrary website via a URL parameter...

Drupal Feature Set Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Feature Set is one of the modules used to enable or disable a feature or group of modules. A cross-site request forgery vulnerability exists in the Drupal Feature Set module. A remote...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Spider Contacts Module

Drupal is an open source content management platform. Multiple cross-site request forgery vulnerabilities exist in the Drupal Spider Contacts module, which could be exploited by an attacker to perform certain unauthorized actions and gain access to vulnerable applications...

Drupal Node Access Product Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node Access Product is one of the node access modules. A cross-site scripting vulnerability exists in the Drupal Node Access Product module, which stems from the program's failure to...

Multiple vulnerabilities in Drupal Node basket Payments module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Node basket Payments is one of the modules that allows nodes to be selected from the current session store for payment operations. A cross-site scripting vulnerability and a cross-site...

Multiple Vulnerabilities in Drupal Commerce Balanced Payments Module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Commerce Balanced Payments is one of the payment modules. A cross-site scripting vulnerability and a cross-site request forgery vulnerability exists in the Drupal Commerce Balanced...

SA-CONTRIB-2015-067 - Finder - Open Redirect

Finder module allows you to create flexible faceted search forms to find entities such as nodes or users based on the values of fields and database attributes. The provided function finderformgoto is susceptible to a phishing attack. An attacker could formulate a redirect in a way that gets the...

SA-CONTRIB-2015-068 - Campaign Monitor - Cross Site Request Forgery (CSRF)

Campaign Monitor module integrates the Campaign Monitor API into Drupal. The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause another user to enable and disable list subscriptions by getting their browser to make a request to a specially-crafted URL. CVE...

SA-CONTRIB-2015-073 - Trick Question - Cross Site Scripting (XSS)

The Trick Question is a CAPTCHA-type spam prevention module; a lightweight, compact and simple alternative to larger and more complex modules. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. The vulnerability is...

SA-CONTRIB-2015-071 - Simple Subscription - Cross Site Scripting (XSS)

This module enables you to add a block to allow visitors to subscribe to a site's newsletter. The module failed to sanitize some block content, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...

SA-CONTRIB-2015-070 - Mover - Cross Site Scripting (XSS) - Unsupported

The Mover modules provide the ability to move content between Drupal sites. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to...

SA-CONTRIB-2015-069 - Taxonomy Accordion - Cross Site Scripting (XSS) - Unsupported

Taxonomy Accordion module creates a block for each taxonomy vocabularies. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a user allowed to...

SA-CONTRIB-2015-072 - Commerce Ogone - Access bypass

This module enables you to use Ogone Ingenico as a payment method for Drupal Commerce. Malicious users can trick Commerce Ogone into proceeding with the checkout process without actually going through the Ogone payment process, causing the order status to be set to checkout complete, even though ...

SA-CONTRIB-2015-065 - Registration codes - Multiple vulnerabilities

Registration codes module allows new account registrations only for users who provide a valid registration code. The module was not properly sanitizing user supplied text in some pages, thereby exposing XSS vulnerabilities. Additionally, some URLs were not protected against CSRF, a malicious user...

SA-CONTRIB-2015-064 - Ubercart Discount Coupons - Cross Site Scripting (XSS)

Ubercart Discount Coupons module provides discount coupons for Ubercart stores. The module doesn't sufficiently sanitize user supplied text in some administration pages, thereby exposing a Cross Site Scripting vulnerability. The vulnerability is mitigated by the fact that an attacker must have a...

SA-CONTRIB-2015-063 - Webform - Cross Site Scripting (XSS)

Webform enables you to create surveys, personalized contact forms, contests, and the like. Cross Site Scripting Related to Webform Submissions The module doesn't sufficiently escape user data presented to administrative users in the webform results table. This issue affects the 7.x-4.x branch onl...

SA-CONTRIB-2015-066 - Tracking Code - Cross Site Request Forgery (CSRF)

Tracking Code module allows you to create tracking code snippets and control their visibility. The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause an administrator to disable tracking codes by getting their browser to make a request to a specially-crafted UR...