677 matches found
CVE-2013-1779
Cross-site scripting XSS vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...
PT-2013-3390
Name of the Vulnerable Software and Affected Versions Clean Theme versions prior to 7.x-1.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users with the administer themes permission to inject arbitrary web script or...
PT-2013-3385
Name of the Vulnerable Software and Affected Versions Drupal Fresh theme versions prior to 7.x-1.4 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the administer themes permission to inject arbitrary web script or HTML. Recommendations For versions...
PT-2013-3387
Name of the Vulnerable Software and Affected Versions Drupal Professional theme versions prior to 7.x-1.4 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the administer themes permission to inject arbitrary web script or HTML. Recommendations For...
PT-2013-3389
Name of the Vulnerable Software and Affected Versions Drupal Business theme versions prior to 7.x-1.8 Description A cross-site scripting XSS issue exists in the 3 slide gallery in page--front.tpl.php, allowing remote authenticated users with the administer themes permission to inject arbitrary we...
PT-2013-3393
Name of the Vulnerable Software and Affected Versions Simple Corporate theme versions prior to 7.x-1.4 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML...
PT-2013-2194
Name of the Vulnerable Software and Affected Versions Drupal Boxes module versions 7.x-1.x before 7.x-1.1 Description A cross-site scripting issue exists, allowing remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter...
PT-2013-2232
Name of the Vulnerable Software and Affected Versions Drupal Taxonomy Manager module versions 6.x-2.x before 6.x-2.2 Drupal Taxonomy Manager module versions 7.x-1.x before 7.x-1.0-rc1 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authenticatio...
CVE-2013-1779: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...
CVE-2013-1781: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the 3 slide gallery in the Professional theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...
CVE-2013-1782: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons...
CVE-2013-1785: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...
PT-2013-3386
Name of the Vulnerable Software and Affected Versions Best Responsive Theme versions 7.x-1.x before 7.x-1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote authenticated users with the administer themes permission to inject arbitrary web script or...
CVE-2013-1786: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors...
CVE-2013-0206
Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a...
CVE-2013-0225
The CVE-2013-0225 entry concerns the Drupal User Relationships contributed module, not Drupal core. Affected versions are 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5. The root cause is insufficient escaping of the relationship name, allowing remote authenticated users with the "admin...
CVE-2013-0225
Cross-site scripting XSS vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a relationship name...
PT-2013-2168
Name of the Vulnerable Software and Affected Versions Drupal User Relationships module versions 6.x-1.x before 6.x-1.4 Drupal User Relationships module versions 7.x-1.x before 7.x-1.0-alpha5 Description A cross-site scripting XSS issue exists in the User Relationships module for Drupal, allowing...
PT-2013-2157
Name of the Vulnerable Software and Affected Versions Drupal Live CSS module versions 6.x-2.x before 6.x-2.1 Drupal Live CSS module versions 7.x-2.x before 7.x-2.7 Description The issue allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading ...