CVE-2014-8076

Cross-site scripting XSS vulnerability in the Professional theme 7.x before 7.x-2.04 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to custom copyright information...

CVE-2014-8077

The CVE-2014-8077 entry concerns the NewsFlash theme for Drupal (versions 6.x-1.x prior to 6.x-1.7 and 7.x-1.x prior to 7.x-2.5). The underlying issue is insufficient sanitization of the font family CSS property in user-provided theme settings, enabling an XSS vector. Impact is limited to remote ...

CVE-2014-8078

Cross-site scripting XSS vulnerability in the Print aka Printer, e-mail and PDF versions module 6.x-1.x before 6.x-1.19, 7.x-1.x before 7.x-1.3, and 7.x-2.x before 7.x-2.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors...

CVE-2014-8078

The CVE-2014-8078 entry maps to a Drupal vulnerability in the Print (Printer, e‑mail and PDF versions) contributed module. Affected versions are 6.x-1.x before 6.x-1.19, 7.x-1.x before 7.x-1.3, and 7.x-2.x before 7.x-2.0. The root cause is insufficient sanitization of user input during the genera...

CVE-2014-8075

Cross-site scripting XSS vulnerability in the Tribune module 6.x-1.x and 7.x-3.x for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...

CVE-2014-7979

Cross-site scripting XSS vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

CVE-2014-7980

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

CVE-2014-7978

Cross-site scripting XSS vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

Cross site scripting

Cross-site scripting XSS vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

Cross site scripting

Cross-site scripting XSS vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

CVE-2014-7980

Zen theme for Drupal 7.x is affected by CVE-2014-7980, with multiple XSS vulnerabilities in template.php. The issues allow remote authenticated users with the administer themes permission to inject arbitrary script/HTML via skip_link_text and other theme settings. Affected versions: Zen 7.x-5.x b...

CVE-2014-7980

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

CVE-2014-7979

Cross-site scripting XSS vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

CVE-2014-7978

The CVE-2014-7978 entry concerns the Bluemasters (BlueMasters) Drupal 7.x-2.x theme. The vulnerability is a stored/reflected XSS caused by insufficient sanitization of theme settings, allowing remote authenticated users with the administer themes permission to inject arbitrary script/HTML via the...

CVE-2014-7979

CVE-2014-7979 is an XSS vulnerability in the SimpleCorp Drupal theme (7.x-1.x) affecting 7.x-1.0 prior to 7.x-1.1. The issue allows remote authenticated users with the administer themes permission to inject arbitrary script/HTML via theme settings. Exploitation details are not provided in the ini...

CVE-2014-7978

Cross-site scripting XSS vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

SA-CONTRIB-2014-097 - nodeaccess - Access Bypass

Nodeaccess is a Drupal access control module which provides view, edit and delete access to nodes. This module enables you to inadvertently allow an author of a node view/edit/delete the node in question who may not have access. The module over-eagerly grants read/write/delete access to all autho...

SA-CONTRIB-2014-102 - Document - Cross Site Scripting

Document module is a basic Document Management System for Drupal. Cross Site Scripting XSS The module wasn't sanitizing user input sufficiently in a few use cases. This vulnerability is mitigated by the the fact that a user must have permissions to add or edit documents to be able to exploit the...

SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS)

OAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication. Within its API code the Client class exposes variables in an error message, which originate from a third party source without proper sanitisation thus leading to a Cross Site Scripti...