EUVD-2015-3429

Malware in sbrugna...

CVE-2015-3388

Cross-site request forgery CSRF vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors...

CVE-2015-3384

Cross-site scripting XSS vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3384

Cross-site scripting XSS vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3388

CVE-2015-3388 affects Drupal’s Commerce Balanced Payments module. A CSRF flaw allows an attacker to hijack a user’s session to trigger requests that delete the user’s configured bank accounts via unspecified vectors. Public advisories indicate CSRF (and related XSS) in Commerce Balanced Payments ...

CVE-2015-3388

Cross-site request forgery CSRF vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors...

CVE-2015-3384

CVE-2015-3384 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Commerce Balanced Payments module, specifically affecting the Bank Account Listing Page. The root cause is insufficient sanitization of user-supplied text in that page, enabling remote authenticated users to inject arbitrar...

PT-2015-6204

Name of the Vulnerable Software and Affected Versions Drupal Commerce Balanced Payments module affected versions not specified Description A cross-site scripting XSS issue exists in the Bank Account Listing Page of the Commerce Balanced Payments module, allowing remote authenticated users to inje...

CVE-2015-3388: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Commerce Balanced Payments module for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured bank accounts via unspecified vectors...

PT-2015-6208

Name of the Vulnerable Software and Affected Versions Drupal Commerce Balanced Payments module affected versions not specified Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of arbitrary users for requests that delete the user's configured...

CVE-2015-3384: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Bank Account Listing Page in the Commerce Balanced Payments module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Multiple Vulnerabilities in Drupal Commerce Balanced Payments Module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Commerce Balanced Payments is one of the payment modules. A cross-site scripting vulnerability and a cross-site request forgery vulnerability exists in the Drupal Commerce Balanced...

SA-CONTRIB-2015-043 - Commerce Balanced Payments - Multiple vulnerabilities

Commerce Balanced Payments module integrates Drupal Commerce with the Balanced Payments third-party service. The module doesn't sufficiently sanitize user supplied text in the Bank Account Listing Page, thereby exposing a Cross Site Scripting vulnerability. Also, some URLs were not protected...