CVE-2015-6665

Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...

CVE-2015-6659

SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment...

CVE-2015-6661

Removed by vendor...

CVE-2015-6659

Removed by vendor...

CVE-2015-6658

Removed by vendor...

CVE-2015-6665

Removed by vendor...

CVE-2015-6660

Removed by vendor...

PT-2015-7309

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.36 Drupal versions 7.x through 7.38 Description A cross-site scripting XSS issue in the Autocomplete system allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading...

PT-2015-7313

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.39 Ctools module versions prior to 6.x-1.14 for Drupal Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML...

PT-2015-7310

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.39 Description A SQL injection issue exists in the SQL comment filtering system of the Database API, allowing remote attackers to execute arbitrary SQL commands via an SQL comment. Recommendations For versions prior ...

PT-2015-7311

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.37 Drupal versions 7.x before 7.39 Description The issue concerns the Form API in Drupal, which fails to properly validate the form token. This allows remote attackers to conduct CSRF attacks, enabling them to uplo...

PT-2015-7312

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x through 6.36 and 7.x through 7.38 Description The issue allows remote attackers to obtain sensitive node titles by reading the menu. Recommendations For Drupal versions 6.x through 6.36, update to version 6.37 or later. For...

CVE-2015-6661: Exposure of Sensitive Information to an Unauthorized Actor

Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu...

CVE-2015-6660: Cross-Site Request Forgery (CSRF)

The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks."...

CVE-2015-6665: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...

CVE-2015-6658: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...

CVE-2015-6659: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to execute arbitrary SQL commands via an SQL comment...

FreeBSD : drupal -- multiple vulnerabilities (9393213d-489b-11e5-b8c7-d050996490d0)

Drupal development team reports : This security advisory fixes multiple vulnerabilities. See below for a list. Cross-site Scripting - Ajax system - Drupal 7 A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax on a whitelisted HTM...

Drupal Ajax System Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Ajax System, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies,...

Drupal Menu Links Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP. A security vulnerability exists in Drupal Menu Links that allows remote attackers to exploit the vulnerability to submit special requests to obtain sensitive information...