14605 matches found
SA-CONTRIB-2015-001 - OPAC - Cross Site Request Forgery (CSRF)
OPAC module enables you to create mappings between node fields and ILS record fields. The module doesn't ask for confirmation when removing a mapping, leaving this operation vulnerable to cross-site request forgery CSRF attacks. CVE identifiers issued CVE-2015-3343 Versions affected OPAC 7.x-2.x...
SA-CONTRIB-2015-003 - PHPlist Integration Module - SQL Injection
The PHPlist Integration module provides an integration between a Drupal website and phpList newsletter manager. The module provides two main features: user sync and sending a node as a newsletter. The module introduces a SQL Injection vulnerability to the phpList database. The Drupal database is...
SA-CONTRIB-2015-008 - Batch Jobs - Cross Site Request Forgery (CSRF)
The Batch Jobs project is a scalable way to execute a list of tasks. Links that take actions on batch jobs are not protected from Cross Site Request Forgery CSRF. A malicious individual could cause a user that has permission to access a particular batch job or an administrator to delete the recor...
SA-CONTRIB-2015-009 - Linkit - Cross Site Scripting (XSS)
Linkit provides an easy interface for internal and external linking with wysiwyg editors and fields by using an autocomplete field. The module doesn't sufficiently sanitize node titles in the result list if the node search plugin is enabled. This vulnerability is mitigated by the fact that an...
SA-CONTRIB-2015-013 - Field Display Label - Cross Site Scripting (XSS)
This module enables you to use a different label for displaying fields from the label used when viewing the field in a form. The module doesn't sufficiently sanitize the alternate field label in content types settings. This vulnerability is mitigated by the fact that an attacker must have a role...
SA-CONTRIB-2015-010 - Log Watcher - Cross Site Request Forgery (CSRF)
Log Watcher allows you to monitor your site logs in a systematic way by setting up scheduled aggregations for specific log types. The report administration links are not properly protected from CSRF. A malicious user could cause a log administrator to enable, disable, or delete a Log Watcher repo...
SA-CONTRIB-2015-012 - Jammer - Cross Site Request Forgery (CSRF)
This module enables you to hide or remove items from displaying including the node and comment preview buttons, node delete button, revision log textarea, workflow form on the workflow tab, and feed icon. The report administration links are not properly protected from CSRF. A malicious user could...
SA-CONTRIB-2015-002 - Course - Cross Site Scripting (XSS)
Course module enables you to create e-learning courses with any number of requirements for completion. The module doesn't sufficiently filter node title displays when being used in a course. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to creat...
SA-CONTRIB-2015-004 - Context - Open Redirect
Context allows you to manage contextual conditions and reactions for different portions of your site. Context UI module wasn't checking for external URLs in the HTTP GET destination parameter when redirecting users that are activating/deactivating the Context UI inline editor dialog, thereby...
SA-CONTRIB-2015-006 - Cloudwords for Multilingual Drupal - Multiple vulnerabilities
This module provides integration with the Cloudwords third-party service. The module was not sanitizing node titles on certain conditions, thereby leading to a Cross Site Scripting XSS vulnerability. Also, a menu callback was not protected against CSRF. The XSS vulnerability is mitigated by the...
SA-CONTRIB-2015-011 - Todo Filter - Cross Site Request Forgery (CSRF)
Todo Filter module provides an input filter to display check-boxes that can be used as a task list. Some paths were not protected against CSRF, meaning that an attacker could cause users to toggle tasks they did not intend to toggle by getting the user's browser to make a request to a...
SA-CONTRIB-2015-005 - WikiWiki - SQL injection
WikiWiki module gives you one place to create, share and find wiki pages in your site. The module did not sanitize user input inside a database query thereby leading to a SQL Injection vulnerability. CVE identifiers issued CVE-2015-3346 Versions affected WikiWiki 6.x-1.x versions prior to 6.x-1.2...
SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF)
The Htaccess module allows the creation and deployment of .htaccess files based on custom settings. Some administration links were not properly protected from Cross Site Request Forgery CSRF. A malicious user could cause an administrator to deploy or delete .htaccess files by getting the...
Multiple Vulnerabilities in Drupal Open Atrium Module
Drupal is a free and open source content management system developed in PHP. A cross-site request forgery, security bypass vulnerability exists in Drupal Open Atrium Module. An attacker can exploit this vulnerability to bypass security restrictions, gain unauthorized access, or perform unauthoriz...
[REVIVE-SA-2014-002] Revive Adserver 3.0.6 and 3.1.0 fix multiple vulnerabilities
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2014-002 ------------------------------------------------------------------------ http://www.revive-adserver.com/security/revive-sa-2014-002...
Revive Adserver 3.0.5 Cross Site Scripting / Denial Of Service
======================================================================== Revive Adserver Security Advisory REVIVE-SA-2014-002 ------------------------------------------------------------------------ http://www.revive-adserver.com/security/revive-sa-2014-002...
SA-CONTRIB-2014-126 - Open Atrium - Multiple vulnerabilities
This distribution enables you to create an intranet. Several of the sub modules included do not prevent CSRF on several menu callbacks. Open Atrium Discussion also does not exit correctly after checking access on a several ajax callbacks, allowing anyone with "access content" to update and delete...
SA-CONTRIB-2014-128 - Organic Groups Menu - Access bypass
This module enables you to associate menus with Organic Groups OG. It allows you to create one or more menus per group, configure and apply menu permissions in a group context, add/edit menu links directly from the entity form, etc. The module doesn't sufficiently check the menu parameters passed...
SA-CONTRIB-2014-127 - School Administration - Cross Site Scripting (XSS)
School Administration module enables you to keep records of all students and staff. With inner modules, it aims to be a complete school administration system. The module failed to sanitize some node titles in messages, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is...
