17322 matches found
CVE-2013-4228: Incorrect Authorization
The OG access fields visibility fields implementation in Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal does not properly restrict access to private groups, which allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via...
CVE-2013-4227: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the personaxsrftoken function in persona.module in the Mozilla Persona module 7.x-1.x before 7.x-1.11 for Drupal allows remote attackers to hijack the authentication of aribitrary users via a security token that is not a string data type...
PT-2020-7486
Name of the Vulnerable Software and Affected Versions: Mozilla Persona module versions 7.x-1.x through 7.x-1.10 Description: A cross-site request forgery CSRF issue exists in the persona xsrf token function within the persona.module of the Mozilla Persona module for Drupal. This allows remote...
PT-2020-7487
Name of the Vulnerable Software and Affected Versions: Organic Groups OG module versions 7.x-2.x before 7.x-2.3 for Drupal Description: The issue allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors, due to the...
PT-2020-7485
Name of the Vulnerable Software and Affected Versions: Drupal Authenticated User Page Caching Authcache module versions 7.x-1.x before 7.x-1.5 Description: The issue allows remote attackers with the same role-combination as the superuser to obtain sensitive information via the cached pages of the...
CVE-2013-4225
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
Cross site scripting
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
CVE-2013-4225
The RESTful Web Services (RESTWS) module for Drupal is vulnerable in versions 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 due to insufficient restriction of access to entity write operations. This allows remote authenticated users with permissions such as "access resource node" and "create ...
CVE-2013-4225
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
CVE-2013-4225
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
drupal.okeyno.com Improper Access Control vulnerability
Open Bug Bounty ID: OBB-1089677 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...
HackerOne: 404-response contains debug-information with all headers
Summary: When requesting a page that does not exist under www.hackerone.com the page returns a hidden HTML-element debugData that reflects all headers in the GET-request, including http-only cookies. Description: This in itself is not a serious vulnerablity, but as the program description mention...
CVE-2013-4225: Improper Neutralization of Input During Web Page Generation
The RESTful Web Services restws module 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.1 for Drupal does not properly restrict access to entity write operations, which makes it easier for remote authenticated users with the "access resource node" and "create page content" permissions or equivalen...
PT-2020-7484 · Drupal · Drupal Restws Module
Name of the Vulnerable Software and Affected Versions: Drupal restws module versions 7.x-1.x before 7.x-1.4 Drupal restws module versions 7.x-2.x before 7.x-2.1 Description: The issue allows remote authenticated users with certain permissions, such as access resource node and create page content,...
Drupal Views Dynamic Fields Module Code Execution
The vulnerability of the handlers/viewshandlerfilterdynamicfields.inc component in the Drupal “Views Dynamic Fields” module is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code...
Drupal Data SQL Injection Vulnerability
Drupal is an open source content management system developed by the Drupal community using the PHP language. A SQL injection vulnerability exists in Drupal version 6.20, Data 6.x-1.0-alpha14. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based...
Drupal Data Cross-Site Scripting Vulnerability
Drupal is an open source content management system developed by the Drupal community using the PHP language. A cross-site scripting vulnerability exists in Drupal version 6.20, Data 6.x-1.0-alpha14. The vulnerability stems from a lack of proper validation of client-side data by the WEB applicatio...
CVE-2012-5570
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basicwebmail" permission to read arbitrary users' email addresses...
Code injection
The Basic webmail module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with the "access basicwebmail" permission to read arbitrary users' email addresses...
CVE-2012-5570
The CVE-2012-5570 entry concerns Drupal's Basic webmail module (6.x-1.x) prior to 6.x-1.2. The vulnerability allows remote authenticated users with the access basic_webmail permission to read arbitrary users’ email addresses, constituting an information-disclosure flaw. Root cause details are not...