Granting Current Assignee to the Administer Project permissions will allow user to view all Projects

h3. Summary Granting Current Assignee to the Administer Project permissions will allow users to see ALL Projects that are assigned to that Permission Scheme. You can see the projects even if the user does not have any assigned issues in the project or even if the user is not listed as...

CVE-2016-7570

Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes...

PT-2016-7389

Name of the Vulnerable Software and Affected Versions Drupal versions 8.x before 8.1.10 Description The issue allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes, due to improper checking for Administer comments...

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2016-004

Users without "Administer comments" can set comment visibility on nodes they can edit. Less critical Users who have rights to edit a node, can set the visibility on comments for that node. This should be restricted to those who have the administer comments permission. Cross-site Scripting in http...

Piwik - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-043

This module enables you to add integration with Piwik statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is mitigated by the...

Drupal Block Class module cross-site scripting vulnerability (CNVD-2016-02374)

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. Block Class is one of the administrator through the Block configuration interface to add CSS to any Block module . Drupal Block Class module 7.x-2.2 before the 7.x-2.x version of a...

CVE-2016-3144

Cross-site scripting XSS vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name...

PT-2016-5384

Name of the Vulnerable Software and Affected Versions Drupal Block Class module versions 7.x-2.x before 7.x-2.2 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a clas...

Drupal MAYO theme cross-site scripting vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.MAYO theme is one of the modules that provides users with an easy way to define and create a theme of their choice. A cross-site scripting vulnerability exists in Drupal MAYO theme...

CVE-2015-8233

Cross-site scripting XSS vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings...

CVE-2015-8233

The MAYO Drupal theme (7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6) is affected by an XSS vulnerability. Root cause: insufficient sanitization in theme settings that remote administrators with the Administer themes permission can exploit to inject arbitrary script/HTML. Impact: potential fo...

CVE-2015-8233

Cross-site scripting XSS vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote administrators with the "Administer themes" permission to inject arbitrary web script or HTML via unspecified vectors related to theme settings...

PT-2015-7753

Name of the Vulnerable Software and Affected Versions MAYO theme versions 7.x-1.x before 7.x-1.4 MAYO theme versions 7.x-2.x before 7.x-2.6 Description A cross-site scripting XSS issue exists, allowing remote administrators with the "Administer themes" permission to inject arbitrary web script or...

Cross site scripting

Cross-site scripting XSS vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label...

PT-2015-7363

Name of the Vulnerable Software and Affected Versions Drupal Mass Contact module versions 6.x-1.x before 6.x-1.6 Drupal Mass Contact module versions 7.x-1.x before 7.x-1.1 Description A cross-site scripting XSS issue exists in the Mass Contact module for Drupal, allowing remote authenticated user...

CVE-2015-6754

Cross-site scripting XSS vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6754: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors...

Drupal Dynamic display block module security bypass vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Dynamic display block is one of the featured content slideshow modules. A security vulnerability exists in the Drupal Dynamic display block module in versions 7.x-1.1 and earlier. A...

CVE-2015-5513

Cross-site scripting XSS vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspecified vectors related to a login...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the XC NCIP Provider module in the eXtensible Catalog XC Drupal Toolkit allows remote attackers to hijack the authentication of users with the "administer ncip providers" permission for requests that alter NCIP providers via a crafted request...