CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

CVE-2015-5493

The CVE-2015-5493 entry describes a vulnerability in the Drupal Entityform Block module (7.x-1.x before 7.x-1.3). The root cause is improper permission checks when a form is locked to a role, enabling remote attackers to obtain access to certain entityforms via unspecified vectors. Affected softw...

CVE-2015-5512

The CVE-2015-5512 entry concerns the Drupal contributed module “me aliases.” The vulnerability affects me aliases 6.x-2.x prior to 6.x-2.10 and 7.x-1.x prior to 7.x-1.2, where the Views “me” user argument handler can be manipulated by substituting a user ID with the literal string “me” in a URL, ...

CVE-2015-5492

CVE-2015-5492 : A cross-site scripting (XSS) vulnerability was reported in the Drupal Video Consultation module, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors. Affected are all versions of the Video Consultation module (Drupal core not affected). The iss...

CVE-2015-5503

CVE-2015-5503 describes an open redirect in the Drupal Chamilo integration module (7.x-1.x) before 7.x-1.2. The vulnerability enables remote attackers to redirect users to arbitrary websites and conduct phishing via unspecified parameters. Affected component: Chamilo integration module in Drupal ...

CVE-2015-5509

CVE-2015-5509 affects the Drupal contributed module Administration Views (7.x-1.x) prior to 7.x-1.4. When used in combination with other unspecified modules, it can bypass access restrictions to administration pages, allowing remote administrators to view/modify restricted areas. The issue is tie...

CVE-2015-5514

The CVE-2015-5514 issue affects the Drupal Migrate module (7.x-2.x) prior to 7.x-2.8, specifically when the migrate_ui submodule is enabled. The root cause is insufficient sanitization of destination field labels, enabling user-assisted remote attackers to inject arbitrary web script or HTML. Pra...

CVE-2015-5504

SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5491

CVE-2015-5491 concerns the Drupal module Dynamic display block (7.x-1.x) , where versions prior to 7.x-1.1 allow remote authenticated users with the administer ddblock permission to bypass access restrictions and read titles of restricted content. The root cause is improper access control in the ...

CVE-2015-5489

Cross-site scripting XSS vulnerability in the Smart Trim module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors involving the field settings form...

CVE-2015-5501

The CVE covers Drupal’s Hostmaster (Aegir) module (6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2). The underlying issue allows remote attackers to execute arbitrary PHP code by placing a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site envi...

CVE-2015-5515

The CVE-2015-5515 issue affects the Drupal contributed module Views Bulk Operations (VBO) on versions 6.x-1.x and 7.x-3.x prior to 7.x-3.3. The vulnerability arises when the bulk operation for changing Roles is enabled and a user with access to a user listing view (with VBO enabled) can remotely ...

CVE-2015-5500

CVE-2015-5500 is an XSS vulnerability in Drupal’s Navigate module. Public records describe a cross-site scripting flaw that allows remote authenticated users with specific permissions to inject arbitrary script or HTML via unspecified vectors. The available documents identify the affected compone...

CVE-2015-5493

The Entityform Block module 7.x-1.x before 7.x-1.3 for Drupal does not properly check permissions when a form is locked to a role, which allows remote attackers to obtain access to certain entityforms via unspecified vectors...

CVE-2015-5515

The Views Bulk Operations VBO module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO...

CVE-2015-5496

The pass2pdf module for Drupal does not restrict access to generated PDF files, which allows remote attackers to obtain user passwords via unspecified vectors...

CVE-2015-5499

The Drupal Navigate module has insufficient permission checks, allowing remote authenticated users to modify custom widgets and create widget records by exploiting the navigate view permission. CVSSv2 base score 4.0 (Medium). No remediation/version details are provided in the supplied documents.

CVE-2015-5495

Cross-site scripting XSS vulnerability in the Mobile sliding menu module 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer menu" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5487

Cross-site scripting XSS vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view meta information" permission to inject arbitrary web script or HTML via unspecified vectors related to the meta access...

CVE-2015-5491

The Dynamic display block module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users to bypass intended access restrictions and read sensitive titles by leveraging the "administer ddblock" permission...