565 matches found
CVE-2012-5554
The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...
Default configuration
The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...
CVE-2012-5554
The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...
CVE-2012-5554
The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...
CVE-2012-5554
The CVE-2012-5554 issue affects Webform CiviCRM Integration for Drupal 7.x-3.x. The vulnerability occurs when Enforce Permissions is disabled in versions 7.x-3.0 through 7.x-3.3, allowing remote attackers to read webforms and obtain contact information. The entry notes this affects configurations...
CVE-2012-5554: Exposure of Sensitive Information to an Unauthorized Actor
The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...
PT-2012-6024
Name of the Vulnerable Software and Affected Versions Webform CiviCRM Integration module versions 7.x-3.x before 7.x-3.2 Description The issue arises from the default configuration of the Webform CiviCRM Integration module, where "Enforce Permissions" is disabled. This configuration allows remote...
CVE-2011-5189
Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...
Cross site scripting
Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...
CVE-2011-5189
Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...
CVE-2011-5189
CVE-2011-5189 affects Drupal's Webform Validation module (versions 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1). The vulnerability is a cross-site scripting (XSS) flaw that can be triggered by remote authenticated users who have permission to update Webform nodes, allowing them to inject ar...
CVE-2011-5189: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...
PT-2012-2166
Name of the Vulnerable Software and Affected Versions Webform Validation module versions 6.x-1.x before 6.x-1.5 Webform Validation module versions 7.x-1.x before 7.x-1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote authenticated users with...
CVE-2012-1660
Multiple cross-site scripting XSS vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select or other" module is enabled, allow remote authenticated users with the create webform content permission to inject...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select or other" module is enabled, allow remote authenticated users with the create webform content permission to inject...
CVE-2012-1660
Multiple cross-site scripting XSS vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select or other" module is enabled, allow remote authenticated users with the create webform content permission to inject...
CVE-2012-1660
The CVE-2012-1660 issue affects the Drupal Webform module (component: Webform) via the Select (or Other) submodule. Vulnerable versions are Webform 6.x-3.x before 6.x-3.17 and Webform 7.x-3.x before 7.x-3.17, where XSS can be injected by remote authenticated users who have the create webform cont...
PT-2012-3424
Name of the Vulnerable Software and Affected Versions Drupal Webform module versions 6.x-3.x before 6.x-3.17 Drupal Webform module versions 7.x-3.x before 7.x-3.17 Description The issue affects the Webform module in Drupal, specifically in components/select.inc, when the "Select or other" module ...
CVE-2012-1660: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select or other" module is enabled, allow remote authenticated users with the create webform content permission to inject...
SA-CONTRIB-2012-035 - Webform Cross Site Scripting (XSS)
CVE: CVE-2012-1660 The Webform module allows content creators to assemble a survey for end-users. The module doesn't sufficiently filter user supplied text when displaying radio buttons or checkboxes when used in combination with the Select or Other... module. This vulnerability is mitigated by t...