CVE-2015-7227

The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels...

CVE-2015-7229

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

CVE-2015-7228

The RESTful module 7.x-1.x before 7.x-1.3 for Drupal does not properly cache pages of authenticated users when using non-cookie authentication providers, which allows remote attackers to obtain sensitive information via unspecified vectors...

CVE-2015-7228

The CVE-2015-7228 issue affects Drupal’s RESTful module (7.x-1.x) prior to 7.x-1.3. The vulnerability arises because the RESTful module does not properly cache pages for authenticated users when using non-cookie authentication providers, which can allow remote attackers to obtain sensitive inform...

CVE-2015-7231

The Drupal Commerce Commonwealth (CBA) module for Drupal 7.x-1.x is affected by an input validation flaw in payment processing. Specifically, versions prior to 7.x-1.5 do not sufficiently validate gateway interactions, allowing a remote attacker to craft a URL that makes a failed payment appear v...

CVE-2015-7233

CVE-2015-7233 describes a CSRF vulnerability in the Drupal OSF module (7.x-3.x) before 7.x-3.1 when the OSF Import module is enabled. The issue allows remote attackers to hijack an administrator’s authenticated session to create new OSF datasets via unspecified vectors. Affected component is the ...

CVE-2015-7226

CVE-2015-7226 affects the Drupal contributed module Administration Views (7.x) , specifically versions in the 7.x-1.x branch prior to 7.x-1.5. The root cause is that access checks are performed based on the router path extracted from the view rather than the view’s display property, enabling info...

CVE-2015-7234

The vulnerability CVE-2015-7234 affects the Drupal OSF module (7.x-3.x) prior to 7.x-3.1 when the OSF Ontology and OSF Import modules are enabled. A user-assisted remote attacker can delete arbitrary files via unspecified vectors. The issue is mitigated by upgrading to OSF 7.x-3.1 (as documented ...

CVE-2015-7230

The vulnerability CVE-2015-7230 affects the Drupal Contributed module Workbench Email (7.x-3.x) prior to 7.x-3.4. Remote authenticated users with certain permissions can bypass node and field validation when saving a node, enabling possible unintended content handling. Affected product/version: W...

CVE-2015-7232

The CVE-2015-7232 issue affects the OSF for Drupal module (Drupal 7.x) specifically in the 7.x-3.x line prior to 7.x-3.1, when the OSF Ontology module is enabled. The vulnerability is a Cross-Site Scripting (XSS) in unspecified administration pages, allowing remote attackers to inject arbitrary s...

CVE-2015-7229

The Drupal Twitter module vulnerability CVE-2015-7229 affects Drupal sites using the Twitter submodule (6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, 7.x-6.x before 7.x-6.0). The root cause is improper access checks, allowing remote authenticated users with the post to twitter, add twitter acco...

CVE-2015-7232

Cross-site scripting XSS vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-7226

The Administration Views module 7.x-1.x before 7.x-1.5 for Drupal checks access permissions based on the router path from the view instead of the display property, which allows remote attackers to obtain sensitive information via vectors related to the access handler...

CVE-2015-7233

Cross-site request forgery CSRF vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors...

CVE-2015-7232: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-7227: Undefined Security Weakness

The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels...

PT-2015-7483

Name of the Vulnerable Software and Affected Versions Drupal OSF module versions 7.x-3.x before 7.x-3.1 Description A cross-site request forgery CSRF issue exists in the OSF module for Drupal. This issue allows remote attackers to hijack the authentication of administrators for requests that crea...

PT-2015-7479

Name of the Vulnerable Software and Affected Versions Drupal Twitter module versions 6.x-5.x through 6.x-5.1 Drupal Twitter module versions 7.x-5.x through 7.x-5.8 Drupal Twitter module versions 7.x-6.x through 7.x-5.9 is not accurate since 7.x-6.x is before 7.x-6.0, so it should be Drupal Twitte...

PT-2015-7478

Name of the Vulnerable Software and Affected Versions Drupal RESTful module versions 7.x-1.x before 7.x-1.3 Description The issue concerns the RESTful module for Drupal, where it fails to properly cache pages for authenticated users when non-cookie authentication providers are used. This allows...

CVE-2015-7231: Improper Input Validation

The Commerce Commonwealth CBA module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."...