433 matches found
CVE-2015-4357
The CVE-2015-4357 vulnerability affects the Drupal Webform contributed module. Specifically, Webform 6.x prior to 6.x-3.22, 7.x prior to 7.x-3.22, and 7.x-4.x prior to 7.x-4.4 allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title that is...
CVE-2015-4356
Cross-site scripting XSS vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform...
CVE-2015-4354
Cross-site scripting XSS vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-4356
CVE-2015-4356 affects the Drupal Webform module (7.x-4.x) before 7.x-4.4. The vulnerability is an XSS in the view-based webform results table, exploitable by remote authenticated users with certain permissions to inject arbitrary script/HTML via a webform. The root cause is insufficient escaping ...
CVE-2015-4379
CVE-2015-4379 affects the Drupal Webform Multiple File Upload module (versions 6.x-1.x prior to 6.x-1.3 and 7.x-1.x prior to 7.x-1.3). The underlying issue is a CSRF vulnerability that allows remote attackers to hijack the authentication of certain users to perform file-deletion actions via unspe...
CVE-2015-4379
Cross-site request forgery CSRF vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors...
CVE-2015-4384
Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-4354
CVE-2015-4354 is an XSS vulnerability in the Drupal Ubercart Webform Integration module (affected: version 6.x-1.8 and 7.x before 7.x-2.4). The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors, due to insufficient inpu...
CVE-2015-4357
Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...
CVE-2015-4384
CVE-2015-4384 describes a cross-site scripting (XSS) vulnerability in the Ubercart Webform Checkout Pane module for Drupal. The issue affects Ubercart Webform Checkout Pane 6.x-3.x up to before 6.x-3.10 and 7.x-3.x up to before 7.x-3.11, arising because the module does not sufficiently sanitize u...
PT-2015-6566
Name of the Vulnerable Software and Affected Versions Ubercart Webform Checkout Pane module versions 6.x-3.x before 6.x-3.10 Ubercart Webform Checkout Pane module versions 7.x-3.x before 7.x-3.11 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote...
CVE-2015-4356: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform...
CVE-2015-4379: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors...
PT-2015-6561
Name of the Vulnerable Software and Affected Versions Webform Multiple File Upload module versions 6.x-1.x before 6.x-1.3 Webform Multiple File Upload module versions 7.x-1.x before 7.x-1.3 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of...
PT-2015-6539
Name of the Vulnerable Software and Affected Versions Drupal Webform module versions prior to 6.x-3.22 Drupal Webform module versions 7.x-3.x prior to 7.x-3.22 Drupal Webform module versions 7.x-4.x prior to 7.x-4.4 Description The issue allows remote authenticated users with certain permissions ...
CVE-2015-4357: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...
PT-2015-6538
Name of the Vulnerable Software and Affected Versions Drupal Webform module versions 7.x-4.x before 7.x-4.4 Description A cross-site scripting XSS issue exists in the view-based webform results table of the Webform module for Drupal, allowing remote authenticated users with specific permissions t...
CVE-2015-4384: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...
PT-2015-6536
Name of the Vulnerable Software and Affected Versions Ubercart Webform Integration module versions prior to 6.x-1.8 Ubercart Webform Integration module versions prior to 7.x-2.4 Description The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML...
CVE-2015-4354: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...