CVE-2015-2750

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence...

CVE-2015-2749

Removed by vendor...

CVE-2015-2750

Removed by vendor...

CVE-2015-7880: Exposure of Sensitive Information to an Unauthorized Actor

The Entity Registration module 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to obtain sensitive event registration information by leveraging the "Register other accounts" permission and knowledge of usernames...

CVE-2015-2750: URL Redirection to Untrusted Site

Open redirect vulnerability in URL-related API functions in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the "//" initial sequence...

CVE-2015-2749: URL Redirection to Untrusted Site

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

Flag clear - Moderately Critical - CSRF - DRUPAL-SA-CONTRIB-2017-074

The Flag clear module allows administrators to remove user flags for content. This functionality is often useful in user-submission use-cases, where users do not necessarily need to unflag things on their own. The module doesn't sufficiently confirm a user's intent to take unflagging actions. CVE...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. Malicious users can inject arbitrary web script through the templatestring parameter in TwigEnvironment.php due to incorrect filtering of the parameter...

Information Disclosure And Open Redirect

drupal/core is vulnerable to information disclosure and open redirect attacks. The attacks exist due to a flaw in requesturi code in FormBuilder.php, allowing a malicious user to redirect a user or sensitive data to a malicious website...

Cross-Site Scripting (XSS)

drupal/core is susceptible to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the title field when a node is created through the quick edit module...

SQL Injection

drupal/core is vulnerable to SQL injection attacks. It does not escape the user input to the matchoperator parameter, allowing malicious users to inject and execute arbitrary SQL commands through it...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The attacks exist because the library uses the .text function to escape HTML values in views-admin.js...

Denial Of Service (DoS)

drupal/core is vulnerable to denial of service DoS attacks. Attackers can create a large number of image derivatives when the imageallowinsecurederivatives setting is enabled, consuming server disk space...

Timing Attack

drupal/core is vulnerable to timing attacks. The library is vulnerable because it does not compare CSRF tokens with a constant time string comparison which allows malicious users to use the timing of the request to progressively identify a valid CSRF token...

CVE-2015-7877

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7879

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

Cross site scripting

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

CVE-2015-7877

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7879

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...