CVE-2015-7305

The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context."...

CVE-2015-7307

The CVE-2015-7307 entry describes a cross-site scripting (XSS) vulnerability in the Drupal CMS Updater module (7.x-1.x) prior to version 7.x-1.3. The issue arises on the module’s configuration page where user-supplied text is not properly sanitized, enabling remote attackers to inject arbitrary w...

CVE-2015-7305

The vulnerability CVE-2015-7305 affects the Drupal Scald module (Scald 7.x-1.x) prior to 7.x-1.5, where a misconfiguration allows remote attackers to obtain sensitive atom property information via a debug context, bypassing field restrictions. Affected software is the Scald: Media Management made...

CVE-2015-7306

Summary: CVE-2015-7306 affects the Drupal CMS Updater module (7.x-1.x) prior to 7.x-1.3. The vulnerability is a permission check bypass on the settings access page, enabling remote authenticated users to view and modify settings by abusing the "access administration pages" permission. Affected so...

CVE-2015-7304

CVE-2015-7304 affects the Drupal amoCRM module (7.x-1.x) prior to 7.x-1.2. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data due to improper input handling. Impact is limited to affected amoCRM...

CVE-2015-7307

Cross-site scripting XSS vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

CVE-2015-7307: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

CVE-2015-7306: Improper Access Control

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission...

PT-2015-7514

Name of the Vulnerable Software and Affected Versions amoCRM module versions 7.x-1.x before 7.x-1.2 for Drupal Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data, which can lead to cross-site scripting XSS attacks. Recommendations F...

PT-2015-7516

Name of the Vulnerable Software and Affected Versions Drupal CMS Updater module versions 7.x-1.x before 7.x-1.3 Description The issue allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission, due to improper access permission check...

CVE-2015-7304: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data...

CVE-2015-7305: Exposure of Sensitive Information to an Unauthorized Actor

The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context."...

PT-2015-7517

Name of the Vulnerable Software and Affected Versions Drupal CMS Updater module versions 7.x-1.x before 7.x-1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

Drupal OSF Module Arbitrary File Deletion Vulnerability

Drupal is a free and open source content management system developed in PHP. A security vulnerability exists in the Drupal OSF module, which can be exploited by remote attackers to delete arbitrary files when the OSF Ontology and OSF Import modules are enabled in the program...

Drupal Twitter Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP. The Drupal Twitter module failed to properly check access permissions, allowing a remote attacker to post tweets to arbitrary accounts with the 'post to twitter' permission...

Drupal RESTful Module Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP. The Drupal RESTful module fails to properly cache pages for authenticated users, allowing remote attackers to exploit the vulnerability to obtain sensitive information...

Drupal OSF Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in the Drupal OSF module when the OSF Ontology and OSF Import modules are enabled in the program, which allows remote attackers to construct malicious URIs, trick users...

Drupal Fieldable Panels Panes module security bypass vulnerability

Drupal is a free and open source content management system developed in PHP. Drupal Fieldable Panels Panes fails to check the edit permissions of Fieldable Panels Panes entities, allowing remote attackers to edit panes with the permissions of the edit panel...

CVE-2015-7234

The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors...

CVE-2015-7233

Cross-site request forgery CSRF vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors...