SA-CONTRIB-2013-066 - Monster Menus - Multiple Vulnerabilities

Monster Menus enables you to create granular page permissions, and apply them to a hierarchical page structure. The mmwebform submodule enables you to assign permissions derived from Monster Menus to webform forms. The module doesn't sufficiently filter titles entered into page settings and echoe...

CVE-2013-2129

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label...

CVE-2013-2129

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label...

CVE-2013-2129

The CVE-2013-2129 issue affects the Drupal Webform module (6.x-3.x) prior to 6.x-3.19. It is a Cross-site Scripting (XSS) vulnerability whereby remote authenticated users with the "edit own webform content" or "edit all webform content" permissions can inject arbitrary web script or HTML via a co...

PT-2013-3552

Name of the Vulnerable Software and Affected Versions Drupal Webform module versions 6.x-3.x through 6.x-3.18 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with specific permissions to inject arbitrary web script or HTML via a component label...

CVE-2013-2129: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Webform module 6.x-3.x before 6.x-3.19 for Drupal allows remote authenticated users with the "edit own webform content" or "edit all webform content" permissions to inject arbitrary web script or HTML via a component label...

SA-CONTRIB-2013-050 - Webform - Cross Site Scripting (XSS)

The Webform module allows the creation of custom webforms and surveys. Webform module does not sanitize the labels of created components fields when displaying a list of components to be used in e-mails or downloaded CSV files. This vulnerability is mitigated by the fact that an attacker must hav...

CVE-2012-5554

The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...

Default configuration

The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...

CVE-2012-5554

The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...

CVE-2012-5554

The CVE-2012-5554 issue affects Webform CiviCRM Integration for Drupal 7.x-3.x. The vulnerability occurs when Enforce Permissions is disabled in versions 7.x-3.0 through 7.x-3.3, allowing remote attackers to read webforms and obtain contact information. The entry notes this affects configurations...

CVE-2012-5554

The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...

PT-2012-6024

Name of the Vulnerable Software and Affected Versions Webform CiviCRM Integration module versions 7.x-3.x before 7.x-3.2 Description The issue arises from the default configuration of the Webform CiviCRM Integration module, where "Enforce Permissions" is disabled. This configuration allows remote...

CVE-2012-5554: Exposure of Sensitive Information to an Unauthorized Actor

The default configuration for the Webform CiviCRM Integration module 7.x-3.x before 7.x-3.2 has "Enforce Permissions" disabled, which allows remote attackers to obtain contact information by reading webforms...

CVE-2011-5189

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-5189

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-5189

CVE-2011-5189 affects Drupal's Webform Validation module (versions 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1). The vulnerability is a cross-site scripting (XSS) flaw that can be triggered by remote authenticated users who have permission to update Webform nodes, allowing them to inject ar...

CVE-2011-5189: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to "update Webform nodes" to inject arbitrary web script or HTML via unspecified vectors...