Drupal 'Commerce Invoices' Module SQL Injection and Cross Site Scripting Vulnerabilities

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Ctools Chaos tool suite is one of the API modules used to improve the development experience. SQL injection and cross-site scripting vulnerabilities exist in the Drupal 'Commerce...

Cross-Site Scripting (XSS)

Drupal is susceptible to cross-site scripting XSS attacks. The attacks are possible because the entityLabel and fieldLabel parameters are not properly encoded. When an admin goes to edit the node using quickedit module, the entered script will execute...

[SECURITY] Fedora 25 Update: drupal7-views-3.18-1.fc25

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

[SECURITY] Fedora 26 Update: drupal7-views-3.18-1.fc26

You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...

Page Access - Unsupported - SA-CONTRIB-2017-75

This module will provide the option to give the View and Edit access for users and roles on each node pages. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module,...

Skype Status - Moderately Critical - Cross Site Scripting - DRUPAL-SA-CONTRIB-2017-076

This module enables you to obtain the status for a user's Skype account The module doesn't sufficiently sanitize the user input for their Skype ID. This vulnerability is mitigated by the fact that an attacker must have an account on the site and be allowed to edit/input their Skype ID. CVE...

Page Access - Unsupported - SA-CONTRIB-2017-075

This module will provide the option to give the View and Edit access for users and roles on each node pages. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module,...

Cross-Site Request Forgery (CSRF)

drupal/core is vulnerable to cross-site request forgery CSRF attacks. The attacks exist because it does not use any CSRF protection for the system.runcron command. Depending on the type of command passed through this CSRF attack , this can also lead to a denial of service DoS attack...

Drupal Open Redirect Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An open redirection vulnerability exists in URL-related API functions in Drupal versions 6.x prior to 6.35 and 7.x prior to 7.35. A remote attacker can exploit this...

Drupal Core Multiple Vulnerabilities (SA-CORE-2015-001) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal Core Multiple Vulnerabilities (SA-CORE-2015-001) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Cross-Site Scripting (XSS)

drupal is vulnerable to cross-site scripting XSS attacks. Since the filterXss function does not filter HTML-encoded data attributes, it allows attackers to inject and execute malicious web script through it...

Cross-Site Scripting (XSS)

drupal is vulnerable to cross-site scripting XSS attacks. A malicious user can inject arbitrary scripts through the markup element as it is not sanitized before rendering...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The library does not properly encode the label field in the CKEditor, allowing the malicious user to inject and execute arbitrary javascript through it...

Open redirect

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence...

CVE-2015-7880

The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other accounts" permission and knowledge of usernames...

CVE-2015-2750

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence...

UBUNTU-CVE-2015-2750

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence...

CVE-2015-2749

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

UBUNTU-CVE-2015-2749

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...