309 matches found
CVE-2014-2715
Multiple cross-site scripting XSS vulnerabilities in vwrooms\templates\logout.tpl.php in the VideoWhisper Webcam plugins for Drupal 7.x allow remote attackers to inject arbitrary web script or HTML via the 1 module or 2 message parameter to index.php...
CVE-2014-2983
Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the cached data of different anonymous users, which allows remote anonymous users to obtain sensitive interim form input information in opportunistic situations via unspecified vectors...
SA-CORE-2014-002 - Drupal core - Information Disclosure
Drupal's form API has built-in support for temporary storage of form state, for example user input. This is often used on multi-step forms, and is required on Ajax-enabled forms in order to allow the Ajax calls to access and update interim user input on the server. When pages are cached for...
SA-CONTRIB-2014-029 - Mime Mail - Access Bypass
The MIME Mail module allows to send MIME-encoded e-mail messages with embedded images and attachments. By default the module only allows files to be embedded or attached that are located in the public files directory. The module doesn't sufficiently check the file location, considering similar...
SA-CONTRIB-2014-022 - Slickgrid - Access bypass
The Slickgrid module is an implementation of the jQuery slickgrid plugin, a lightening fast JavaScript grid/spreadsheet. It defines a slickgrid view style, so all data can be output as an editable grid. The module doesn't check access sufficiently, allowing users to edit and change field values o...
SA-CONTRIB-2014-019 - Easy Social - Cross Site Scripting (XSS)
This module enables you to add social sharing widgets to your content and pages. The module doesn't sufficiently validate block titles when a user creates a custom block from within the module's admin interface. This vulnerability is mitigated by the fact that an attacker must have a role with th...
SA-CONTRIB-2014-016 - Mayo Theme - XSS Vulnerability
The theme settings allow you to link to a header background file. A URL could be entered that was not properly sanitized leading to XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer themes". CVE identifiers issued...
SA-CONTRIB-2014-017- Image Resize Filter - Denial of Service (DOS)
This module enables you to resize images based on the HTML contents of a post. Images with specified height and width properties that differ from the original image result in a resized image being created. The module doesn't limit the number of resized images per post or user, which could allow a...
SA-CONTRIB-2014-003 - Doubleclick for Publishers DFP - Cross Site Scripting (XSS)
This module enables you to create blocks to place advertisements from the Google Double Click for Publishers API DFP. The module doesn't sufficiently sanitize the slot names prior to output into HTML. This vulnerability is mitigated by the fact that an attacker must have a role with the permissio...
CVE-2013-6387
Cross-site scripting XSS vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field...
Cross site scripting
Cross-site scripting XSS vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS...
CVE-2013-6387
Cross-site scripting XSS vulnerability in the Image module in Drupal 7.x before 7.24 allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field...
CVE-2013-6387
CVE-2013-6387 is an XSS vulnerability in Drupal 7.x (Image module) prior to 7.24 that allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the description field. Affected product: Drupal 7.x. Root cause: unsanitized input in the image module descri...
CVE-2013-6388
Removed by vendor...
CVE-2013-6387
Removed by vendor...
CVE-2013-6388
Cross-site scripting XSS vulnerability in the Color module in Drupal 7.x before 7.24 allows remote attackers to inject arbitrary web script or HTML via vectors related to CSS...
CVE-2013-6389
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
CVE-2013-6389
Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.24 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...
CVE-2013-6389
Drupal 7.x Overlay module contains an open redirect vulnerability tracked as CVE-2013-6389, fixed in Drupal 7.24. The issue allows remote attackers to redirect users to arbitrary sites and conduct phishing via unspecified vectors. Affected: Drupal 7.x before 7.24 (Overlay module). Impact details ...