SA-CONTRIB-2014-095 - Safeword - Cross Site Scripting (XSS)

The safeword module provides an automatically generated 'Machine Name' when text is entered into a human-readable field. The module doesn't sufficiently sanitize the field description that can be used as help text under the machine name editing field. This vulnerability is mitigated by the fact...

Drupal Core XML-RPC Endpoint xmlrpc.php Tags Denial of Service (CVE-2014-5266)

A denial of service vulnerability has been reported in Drupal Core. The vulnerability can cause a very high CPU load and memory exhaustion. A remote unauthenticated attacker can exploit this vulnerability to cause a denial of service on the vulnerable system...

Drupal Mollom Module Cross-Site Scripting Patch

Drupal today released an update that patches a cross-site scripting vulnerability in a popular spam and content moderation module used by websites built on the open source CMS. The vulnerability was in a feature of the Mollom module that is installed on at least 60,000 sites, said Drupal security...

SA-CONTRIB-2014-090 - Speech recognition - Multiple vulnerabilities

This module enables you to add speech recognition to forms, allowing site admins to enable experimental Speech Input API features on form inputs through the user interface. Cross Site Scripting XSS The module incorrectly prints fields without proper sanitization thereby opening a Cross Site...

SA-CONTRIB-2014-091 - Survey Builder - Cross Site Scripting (XSS)

This module allows you to use the Form Builder module to provide an intuitive interface for building surveys, along with the back-end for storing surveys and their responses. Cross Site Scripting XSS When viewing surveys at "/surveys", the survey titles printed out are not sanitized. Any...

SA-CONTRIB-2014-088 - Mollom - Cross-site scripting (XSS)

Mollom is an "intelligent" content moderation web service which determines if a post is potentially spam; not only based on the posted content, but also on the past activity and reputation of the poster across multiple sites. Mollom offers a feature to report submitted content as inappropriate...

SA-CONTRIB-2014-087 - Drupal Commerce - Information disclosure

Drupal Commerce is used to build eCommerce websites and applications of all sizes. The commerceorder module can be used to create new user accounts where email addresses are used as user names. Since user names are not considered private information in Drupal this is an information disclosure of...

SA-CONTRIB-2014-085 - Ubercart - Information disclosure

The Ubercart module for Drupal provides a shopping cart and e-commerce features for Drupal. The per-user order history view is not properly protected. This vulnerability is mitigated by the fact that an attacker must have an account with the "view own orders" permission and can only view order ID...

SA-CONTRIB-2014-086 - Custom BreadCrumbs - Cross Site Scripting (XSS)

Custom Breadcrumbs allows administrators to set up parametrized breadcrumb trails for different content types, views, panels, taxonomy vocabularies and terms, paths, and a simple API that allows contributed modules to enable custom breadcrumbs for module pages and theme templates. User input is n...

SA-CONTRIB-2014-083 - Rules Link - Cross Site Scripting (XSS)

This module allows you to create links which trigger arbitrary functionality with the help of the Rules module. The module doesn't sufficiently sanitize the question and description strings when confirmation forms are displayed for triggering Rules links. This vulnerability is mitigated by the fa...

CVE-2014-5456

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

Cross site scripting

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

CVE-2014-5456

CVE-2014-5456 relates to the Drupal Social Stats module for 7.x-1.x. The vulnerability is a persistent XSS caused by insufficient filtering of text stored in the module’s configuration, exploitable by remote authenticated users who have the "[Content Type]: Create new content" permission. Affecte...

CVE-2014-5456

Cross-site scripting XSS vulnerability in the Social Stats module before 7.x-1.5 for Drupal allows remote authenticated users with the "Content Type: Create new content" permission to inject arbitrary web script or HTML via vectors related to the configuration...

[SECURITY] Fedora 20 Update: drupal7-date-2.8-1.fc20

This Drupal module contains both a flexible date/time field type and a Date API that other modules can use...

[SECURITY] Fedora 20 Update: drupal7-7.31-1.fc20

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

[SECURITY] Fedora 19 Update: drupal7-date-2.8-1.fc19

This Drupal module contains both a flexible date/time field type and a Date API that other modules can use...

[SECURITY] Fedora 19 Update: drupal7-7.31-1.fc19

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

SA-CONTRIB-2014-080 - Social Stats - Cross Site Scripting (XSS)

The Social Stats module enables you to collect statistics from various social networks and use that data with the Views module as field data, sort criteria, or filter criteria. The module does not sufficiently filter user-supplied text that is stored in the configuration, resulting in a persisten...

SA-CONTRIB-2014-084 - Avatar Uploader - Information Disclosure

The Avatar Uploader enables you to upload user pictures in a user-friendly way, like Quora and Facebook. The module doesn't sufficiently check the picture path when a user crops the picture in the uploader panel allowing a malicious user to make specially crafted requests to obtain sensitive serv...