Design/Logic Flaw

The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors...

Design/Logic Flaw

The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import...

CVE-2015-8754

The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors...

CVE-2015-8761

The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import...

CVE-2015-8761

The vulnerability CVE-2015-8761 affects the Drupal Values module (7.x-1.x) prior to 7.x-1.2. Root cause: insufficient permission checks allow remote administrators with the "Import value sets" permission to run arbitrary PHP code via an exported values list in a ctools import. Impact: potential a...

CVE-2015-8754

The vulnerability CVE-2015-8754 affects the Drupal Mollom module in versions 6.x-2.7 through 6.x-2.14, where insufficient access checks allow remote attackers to bypass access restrictions and modify the site-wide mollom blacklist. The issue arises when handling blacklist entries, enabling unauth...

PT-2016-4862

Name of the Vulnerable Software and Affected Versions Drupal Field Group module version 7.x-1.x before 7.x-1.5 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an...

CVE-2015-8754: Undefined Security Weakness

The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors...

CVE-2015-8761: Improper Control of Generation of Code

The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import...

PT-2016-4006

Name of the Vulnerable Software and Affected Versions Drupal Values module version 7.x-1.x before 7.x-1.2 Description The issue concerns a permission checking problem in the Values module for Drupal. This allows remote administrators with the "Import value sets" permission to execute arbitrary PH...

CVE-2016-1565: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute...

All Drupal Versions Open to Code Execution, Credential Theft Vulnerabilities

A number of issues exist in the content management system Drupal that could lead to code execution and the theft of database credentials via a man-in-the-middle attack, a researcher warns. The vulnerabilities lie in the way Drupal processes updates, according to Fernando Arnaboldi, senior securit...

Field Group - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-001

Field Group module enables you to group fields on entity forms and entity displays. When adding a HTML element as group, the user has the option to add custom HTML attributes on the group. Via this option, a malicious user can embed scripts within the page, resulting in a Cross-site Scripting XSS...

Drupal Open Atrium Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Open Atrium is one of the team collaboration and knowledge management system modules. A cross-site scripting vulnerability exists in Drupal Open Atrium distribution 7.x-2.51 prior to...

Drupal Block Class Module HTML Injection Vulnerability

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. Block Class is one of the administrator through the Block configuration interface to add CSS to any Block module . An HTML injection vulnerability exists in Drupal Block Class modul...

Drupal Values Module Arbitrary PHP Code Execution Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Values is one of the modules used to customize various types of key-value pairs in the backend. An arbitrary PHP code execution vulnerability exists in the Drupal Values module in...

Drupal Encrypt模块信息泄露漏洞

No description provided by source...

Drupal Chat Room Module Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP. Chat Room is one of the modules used to set up the chat room feature on the Drupal website. Drupal Chat Room fails to properly check permissions when setting up websocket sockets for chat messages, which can be exploited...

Drupal Token Insert Entity Module Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP.Token Insert Entity is one of the modules that provides the ability to embed tokens for opened entities or nodes. Drupal Token Insert Entity fails to properly check permissions, which can be exploited by remote attackers ...

CVE-2015-8602

The Token Insert Entity module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which embeds a rendered...