14611 matches found
CVE-2014-8765
CVE-2014-8765 affects the Drupal Project Issue File Review (PIFR) module 6.x-2.x prior to 6.x-2.17. The vulnerability is Cross-Site Scripting (XSS) via a crafted patch that causes PIFR client test results to be sent to the PIFR_Server test results page, and an additional vector where remote authe...
CVE-2014-8765
Multiple cross-site scripting XSS vulnerabilities in the Project Issue File Review module PIFR module 6.x-2.x before 6.x-2.17 for Drupal allow 1 remote attackers to inject arbitrary web script or HTML via a crafted patch, which triggers a PIFR client to test the patch and return the results to th...
CVE-2014-8747
Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...
CVE-2014-8748
Cross-site scripting XSS vulnerability in the Google Doubleclick for Publishers DFP module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name...
CVE-2014-8743
Multiple cross-site scripting XSS vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a 1 Role or 2 Organic Group name...
CVE-2014-8744
Cross-site scripting XSS vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer nivo slider" permission to inject arbitrary web script or HTML via an image title...
CVE-2014-8745
Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label...
CVE-2014-8746
Cross-site scripting XSS vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Maestro module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a 1 Role or 2 Organic Group name...
Cross site scripting
Cross-site scripting XSS vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...
Cross site scripting
Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...
Cross site scripting
Cross-site scripting XSS vulnerability in the Nivo Slider module 7.x-2.x before 7.x-1.11 for Drupal allows remote authenticated users with the "administer nivo slider" permission to inject arbitrary web script or HTML via an image title...
Cross site scripting
Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.13 and 7.x-1.x before 7.x-1.15 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a taxonomy vocabulary label...
Cross site scripting
Cross-site scripting XSS vulnerability in the Google Doubleclick for Publishers DFP module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name...
CVE-2014-8747
Cross-site scripting XSS vulnerability in the Drupal Commons module 7.x-3.x before 7.x-3.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to content creation and activity stream messages...
CVE-2014-8746
Cross-site scripting XSS vulnerability in the Skeleton theme 7.x-1.2 through 7.x-1.3 before 7.x-1.4, for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...
CVE-2014-8748
CVE-2014-8748 is a Drupal DFP (Doubleclick for Publishers) module XSS vulnerability in the 7.x-1.x line, where unsanitized slot names output to HTML allows remote authenticated users with the administer dfp permission to inject arbitrary script or HTML. The affected versions are DFP 7.x-1.x prior...
CVE-2014-8743
CVE-2014-8743 corresponds to XSS in the Drupal Maestro module (7.x-1.x) prior to 7.x-1.4. The root cause is improper filtering of Role or Organic Group names when shown in workflow details, allowing remote authenticated users with certain permissions to inject arbitrary script/HTML. Affected soft...
CVE-2014-8747
CVE-2014-8747 is a cross-site scripting (XSS) vulnerability in Drupal Commons 7.x-3.x (prior to 7.x-3.9) for Drupal. The issue affects messages in the activity stream related to content creation, where unsanitized content could allow injection of arbitrary scripts/HTML. Root cause: inadequate san...
CVE-2014-8748
Cross-site scripting XSS vulnerability in the Google Doubleclick for Publishers DFP module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer dfp" permission to inject arbitrary web script or HTML via a slot name...