CVE-2014-8317

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...

CVE-2014-8318

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields hav...

CVE-2014-8317

The CVE-2014-8317 entry concerns Drupal’s Webform Validation module. A cross-site scripting (XSS) flaw exists in the component name text field in versions 6.x-1.x prior to 6.x-1.6 and 7.x-1.x prior to 7.x-1.4, allowing remote authenticated users with certain permissions to inject arbitrary web sc...

CVE-2014-8318

The issue CVE-2014-8318 affects the Webform contributed module for Drupal. Affected versions: Webform 6.x-3.x before 6.x-3.20; 7.x-3.x before 7.x-3.20; and 7.x-4.x before 7.x-4.0-beta2. Description: remote authenticated users with certain permissions can inject arbitrary web script or HTML via a ...

PT-2014-8466

Name of the Vulnerable Software and Affected Versions Webform Validation module versions 6.x-1.x before 6.x-1.6 Webform Validation module versions 7.x-1.x before 7.x-1.4 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with specific permissions to inject...

PT-2014-8467

Name of the Vulnerable Software and Affected Versions Drupal Webform module versions 6.x-3.x through 6.x-3.19 Drupal Webform module versions 7.x-3.x through 7.x-3.19 Drupal Webform module versions 7.x-4.x through 7.x-4.0-beta1 Description A cross-site scripting XSS issue allows remote authenticat...

CVE-2014-8318: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.20, 7.x-3.x before 7.x-3.20, and 7.x-4.x before 7.x-4.0-beta2 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a field label title, when two fields hav...

CVE-2014-8317: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name text...

SA-CONTRIB-2014-094 - Webform Patched - Cross Site Scripting (XSS)

The Webform Patched module is a fork of the Webform module with Token support added. The module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site. The module doesn't sufficiently sanitize field label titles when two fields have...

SA-CONTRIB-2014-082 - Marketo MA - Cross Site Scripting (XSS)

The Marketo MA module adds Marketo marketing automation tracking capability to your website as well as the ability to capture lead data during user registration and via webform integration. It consists of a base module as well as Marketo MA User Webform and Marketo MA User sub-modules. The Market...

Drupal Webform Template模块安全绕过漏洞

Drupal是一套开放源码的内容管理平台。 该漏洞是由于当显示可能的节点来复制网页表单的配置文件时，应用程序没有正确验证权限, 攻击者可以利用漏洞泄漏其他受限制接点的某些信息。 0 Drupal Webform Template Module 7.x Drupal Webform Template Module 7.x-1.3版本以修复此漏洞，建议用户下载使用： https://drupal.org/node/2216607...

SA-CONTRIB-2014-031 - Webform Template - Access Bypass

This module enables you to copy webform config from one node to another. The module doesn't respect node access when providing possible nodes to copy from. As a result, a user may be disclosed the titles of nodes he does not have view access to and as such he may be able to copy the webform...

SA-CONTRIB-2014-018 - Webform - Cross Site Scripting (XSS)

The Webform module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site. The module doesn't sufficiently sanitize field label titles when two fields have the same formkey, which can only be managed by carefully crafting the webform...

SA-CONTRIB-2014-014 - Webform Validation - Cross Site Scripting (XSS)

The Webform Validation module enables you to add additional form validation rules to Webforms created by the Webform module. The module doesn't sufficiently filter component name text before display, opening up the possibility of cross site scripting. This vulnerability is mitigated by the fact...

SA-CONTRIB-2013-087 - Payment for Webform - Access Bypass

This module enables you to ask for or require payments before users can submit webforms. It previously allowed anonymous users to sometimes use other anonymous users' payments when submitting a form. Payment for Webform never supported anonymous users, but there was also nothing that prevented th...

CVE-2013-4230

The mmwebform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrar...

CVE-2013-4230

The mmwebform submodule in the Monster Menus module 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13 for Drupal does not properly restrict access to webform submissions, which allows remote authenticated users with the "Who can read data submitted to this webform" permission to delete arbitrar...

CVE-2013-4230

The mm_webform submodule in Monster Menus (Drupal 6.x-6.x before 6.x-6.61 and 7.x-1.x before 7.x-1.13) does not properly restrict access to webform submissions, allowing remote authenticated users with the “Who can read data submitted to this webform” permission to delete arbitrary submissions vi...

PT-2013-4912

Name of the Vulnerable Software and Affected Versions Monster Menus module versions 6.x-6.x through 6.x-6.60 Monster Menus module versions 7.x-1.x through 7.x-1.12 Description The issue concerns the mm webform submodule in the Monster Menus module for Drupal, where access to webform submissions i...

SA-CONTRIB-2013-066 - Monster Menus - Multiple Vulnerabilities

Monster Menus enables you to create granular page permissions, and apply them to a hierarchical page structure. The mmwebform submodule enables you to assign permissions derived from Monster Menus to webform forms. The module doesn't sufficiently filter titles entered into page settings and echoe...