Cross site scripting

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

Sql injection

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7879

Cross-site scripting XSS vulnerability in the Stickynote module 7.x before 7.x-1.3 for Drupal allows remote authenticated users with permission to create or edit a stickynote to inject arbitrary web script or HTML via note text on the admin listing page...

CVE-2015-7877

CVE-2015-7877 affects the Drupal User Dashboard module for Drupal 7.x pre-1.4. It describes multiple SQL injection vulnerabilities in the User Dashboard module that allow remote attackers to execute arbitrary SQL commands via unspecified vectors. Affected software: user_dashboard 7.x versions pri...

CVE-2015-7877

Multiple SQL injection vulnerabilities in the User Dashboard module 7.x before 7.x-1.4 for Drupal allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-7879

The CVE-2015-7879 issue affects the Drupal Stickynote module for 7.x, before 7.x-1.3. Root cause: insufficient sanitization of note text on the admin listing page, allowing remote authenticated users with create/edit permission to inject arbitrary script or HTML (XSS). Affected versions: Stickyno...

[SECURITY] Fedora 25 Update: drupal8-8.3.7-1.fc25

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

[SECURITY] Fedora 26 Update: drupal8-8.3.7-1.fc26

Drupal is an open source content management platform powering millions of websites and applications. It=EF=BF=BD=EF=BF=BD=EF=BF=BDs built, used, and supported by an active and diverse community of people around the world...

Drupal Views Refresh Refresh Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Views Refresh Refresh module. This allows an attacker to bypass certain security restrictions and perform unauthorized...

Drupal Views Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Views module. The vulnerability allows attackers to bypass certain security restrictions and perform unauthorized...

Clientside Validation - Critical - Arbitary PHP Execution - DRUPAL-SA-CONTRIB-2017-072

The Clientside Validation module enables you to have clientside Javascript validation on your forms. The module does not sufficiently validate parameters of a POST request made when validating a CAPTCHA. For the 1.x version of this module, this vulnerability is mitigated by the fact that the...

CAPTCHA - Moderately Critical - Denial of Service - SA-CONTRIB-2017-073

This module enables you to use various techniques to block automated scripts / robots from submitting content to a site, e.g. to block spam comments. The module doesn't properly store the session ID of visitors who are given a session which could lead to a Denial of Service attack. This...

H5P - Critical - Reflected Cross Site Scripting (XSS) - DRUPAL-SA-CONTRIB-2017-071

The H5P module helps create interactive videos, question sets, drag and drop questions, multichoice questions, boardgames, presentations, flashcards and more using Drupal. The module does not sufficiently filter text prior to printing it back to the page, leading to a Reflected Cross Site Scripti...

Commerce invoices - Highly Critical - SQL Injection and Cross Site scripting - DRUPAL-SA-CONTRIB-2017-070

Commerce Invoices allows you to enter an Invoice number, Company name and Amount and it will generate an Invoice that the client can pay on your site using any payment method supported by Drupal commerce. SQL Injection The module did not properly use Drupal's database API when querying the databa...

Comission - WhiteBox CMS Analysis

CoMisSion is a tool to quickly analyze a CMS setup. The tool: checks for the core version; looks for the last core version; looks for vulnerabilities in core version used; checks for plugins version; looks for vulnerabilities in plugins version used; A complete report can be generated in XLSX or...

Multiple Unspecified Vulnerabilities in Drupal Session Cache API Module

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Multiple unspecified vulnerabilities exist in the Drupal Session Cache API module. No details of the vulnerabilities are available at this time...

Drupal Relation Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Relation module. An attacker could use the vulnerability to bypass certain security restrictions and perform unauthoriz...

Drupal Better Field Descriptions Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Better Field Descriptions Module due to an inability to properly clean user-supplied input. An attacker can explo...

Drupal Facebook Like Button Module DRUPAL-SA-CONTRIB-2017-066 Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Facebook Like Button module DRUPAL-SA-CONTRIB-2017-066 due to the program failing to properly filter user-supplie...

Drupal 8.x < 8.3.7 Multiple Vulnerabilities (SA-CORE-2017-004)

According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.3.7. It is, therefore, affected by multiple vulnerabilities : - A flaw exists in the views subsystem due to a failure to restrict access to the Ajax endpoint to only views configured ...