CVE-2015-5490

The viewsfetchdata method in includes/cache.inc in the Views module 7.x-3.5 through 7.x-3.10 for Drupal does not rebuild the full cache if the static cache is not empty, which allows remote attackers to bypass intended filters and obtain access to hidden content via unspecified vectors...

CVE-2015-5496

CVE-2015-5496 affects the Drupal pass2pdf module. The vulnerability stems from PDFs generated during user registration not being access-restricted, allowing remote attackers to view password information via unspecified vectors (information disclosure). Affected: all versions of the pass2pdf modul...

CVE-2015-5505

The HTTP Strict Transport Security HSTS module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impac...

CVE-2015-5505

CVE-2015-5505 relates to Drupal’s contributed HTTP Strict Transport Security (HSTS) module. The module versions 6.x-1.x prior to 6.x-1.1 and 7.x-1.x prior to 7.x-1.2 do not correctly implement the include_subdomains directive, causing the HSTS policy not to be applied to subdomains. This is descr...

CVE-2015-5513

CVE-2015-5513 affects Drupal via the Shibboleth authentication module (versions 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2). The root cause is an XSS flaw allowing remote authenticated users with the Administer blocks permission to inject arbitrary scripts/HTML through an unspecified vecto...

CVE-2015-5514

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...

CVE-2015-5489

The Drupal Smart Trim module (7.x-1.x) is affected by an XSS vulnerability in versions prior to 7.x-1.5 due to insufficient input filtering in the field settings form. This allows remote authenticated users with certain permissions to inject arbitrary script/HTML. Impact is partial integrity loss...

CVE-2015-5502

CVE-2015-5502 (Drupal Storage API module) details Affected software: Drupal Storage API module for Drupal 7.x, versions prior to 7.x-1.8 (7.x-1.x lineage). Root cause: The module did not properly restrict access to Storage API fields attached to entities that are not nodes. Impact: This allows re...

CVE-2015-5488

CVE-2015-5488 is a cross-site scripting vulnerability in Drupal’s MailChimp module (significant for the MailChimp Signup submodule) in 7.x-3.x before 7.x-3.3. The issue allows remote authenticated users with the administrator privilege (administer mailchimp) to inject arbitrary script/HTML via un...

CVE-2015-5510

The CVE-2015-5510 entry concerns the Drupal Content Construction Kit (CCK) module. Affected: CCK 6.x-2.x before 6.x-2.10. Root cause: an open redirect vulnerability via the destinations parameter on certain admin pages, allowing remote attackers to redirect users to arbitrary sites (phishing risk...

CVE-2015-5513

Cross-site scripting XSS vulnerability in the Shibboleth authentication module 6.x-4.x before 6.x-4.2 and 7.x-4.x before 7.x-4.2 for Drupal allows remote authenticated users with the "Administer blocks" permission to inject arbitrary web script or HTML via unspecified vectors related to a login...

CVE-2015-5498

The Shipwire API module 7.x-1.x before 7.x-1.03 for Drupal does not check the view permission for the shipments overview admin/shipwire/shipments, which allows remote attackers to obtain sensitive information via a request to the page...

CVE-2015-5497

Cross-site scripting XSS vulnerability in the Web Links module 6.x-2.x before 6.x-2.6 and 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5487

The CVE-2015-5487 issue affects the Camtasia Relay module for Drupal (camtasia_relay), specifically versions 6.x-2.x prior to 6.x-3.2 and 7.x-2.x prior to 7.x-1.3. The root cause is insufficient sanitization of user input under the meta access tab, allowing remote authenticated users with the "vi...

CVE-2015-5500

Cross-site scripting XSS vulnerability in the Navigate module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5514

The CVE-2015-5514 issue affects the Drupal Migrate module (7.x-2.x) prior to 7.x-2.8, specifically when the migrate_ui submodule is enabled. The root cause is insufficient sanitization of destination field labels, enabling user-assisted remote attackers to inject arbitrary web script or HTML. Pra...

CVE-2015-5506

The Apache Solr Real-Time module 7.x-1.x before 7.x-1.2 for Drupal does not check the status of an entity when indexing, which allows remote attackers to obtain information about unpublished content via a search...

CVE-2015-5504

CVE-2015-5504 describes an SQL injection in the Novalnet Payment Module Ubercart for Drupal. The vulnerability stems from failing to sanitize a database query via user-controlled input, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected products: Novalne...

CVE-2015-5508

CVE-2015-5508 refers to a CSRF vulnerability in The eXtensible Catalog (XC) Drupal Toolkit, specifically the XC NCIP Provider module. The issue arises because certain NCIP-Provider-related URLs aren’t sufficiently CSRF-protected, allowing an attacker to cause users with the administer ncip provid...

CVE-2015-5495

The CVE concerns the Drupal Mobile sliding menu module (7.x-2.x) prior to 7.x-2.1. It describes a cross-site scripting (XSS) vulnerability that can be exploited by remote authenticated users who have the 'administer menu' permission to inject arbitrary web script or HTML via unspecified vectors. ...