432 matches found
CVE-2014-5520
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...
PT-2014-6506
Name of the Vulnerable Software and Affected Versions XRMS CRM version 1.99.2 Description The issue allows remote attackers to execute arbitrary SQL commands via the user id parameter to "plugins/webform/new-form.php", which is not properly handled by "plugins/useradmin/fingeruser.php"...
CVE-2014-5520: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in XRMS CRM, possibly 1.99.2, allows remote attackers to execute arbitrary SQL commands via the userid parameter to plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php...
CVE-2013-4594
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...
Design/Logic Flaw
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...
CVE-2013-4594
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...
CVE-2013-4594
The CVE-2013-4594 vulnerability affects the Drupal Payment for Webform module (7.x-1.x) prior to 7.x-1.5. It allows remote anonymous users to access/consume payments made by other anonymous users when submitting a form requiring payment due to insufficient access controls. Remediation: upgrade to...
PT-2014-2840
Name of the Vulnerable Software and Affected Versions Payment for Webform module versions 7.x-1.x before 7.x-1.5 Description The issue allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment, due to the lack of access restriction by...
CVE-2013-4594: Improper Authentication
The Payment for Webform module 7.x-1.x before 7.x-1.5 for Drupal does not restrict access by anonymous users, which allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment...
CVE-2014-8379
Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...
CVE-2014-8379
Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...
CVE-2014-8379
Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...
CVE-2014-8379
Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...
PT-2014-8502
Name of the Vulnerable Software and Affected Versions Marketo MA module versions prior to 7.x-1.5 for Drupal Description The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles in the 1 Webform or 2 User...
CVE-2014-8379: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the Marketo MA module before 7.x-1.5 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to field titles to the 1 Webform or 2 User sub-modules...
CVE-2014-8318
Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields hav...
CVE-2014-8317
Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...
Cross site scripting
Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields hav...
Cross site scripting
Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...