Cross site scripting

A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display...

Sql injection

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

CVE-2011-2715

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

CVE-2011-2715

Drupal 6.20 with Data 6.x-1.0-alpha14 is affected by an SQL Injection vulnerability caused by insufficient sanitization of table names or column names. The flaw can compromise data confidentiality and integrity (per CVE description). The connected records corroborate this issue across multiple so...

CVE-2011-2714

A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display...

CVE-2011-2714

Drupal 6.20 with Data 6.x-1.0-alpha14 is affected by a cross-site scripting vulnerability due to insufficient sanitization of table descriptions, field names, or labels before display. The CVE-2011-2714 entry notes this issue, but the connected sources do not provide exploit details, active explo...

CVE-2011-2715: Improper Neutralization of Special Elements used in an SQL Command

An SQL Injection vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table names or column names...

PT-2020-7109

Name of the Vulnerable Software and Affected Versions Drupal versions 6.20 Description A Cross-Site Scripting issue exists due to insufficient sanitization of table descriptions, field names, or labels before display. Recommendations For version 6.20, ensure proper sanitization of user-input data...

PT-2020-7110

Name of the Vulnerable Software and Affected Versions Drupal versions 6.20 Data module versions 6.x-1.0-alpha14 Description The issue is caused by insufficient sanitization of table names or column names, leading to an SQL Injection vulnerability. Recommendations For Drupal version 6.20, update t...

CVE-2011-2714: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting vulnerability exists in Drupal 6.20 with Data 6.x-1.0-alpha14 due to insufficient sanitization of table descriptions, field names, or labels before display...

CVE-2012-5558

Cross-site scripting XSS vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a smiley acronym...

Cross site scripting

Cross-site scripting XSS vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a smiley acronym...

CVE-2012-5558

Cross-site scripting XSS vulnerability in the Smiley module 6.x-1.x versions prior to 6.x-1.1 and Smileys module 6.x-1.x versions prior to 6.x-1.1 for Drupal allows remote authenticated users with the "administer smiley" permission to inject arbitrary web script or HTML via a smiley acronym...

CVE-2012-5558

CVE-2012-5558 affects Drupal contributed modules Smiley (6.x-1.x before 6.x-1.1) and Smileys (6.x-1.x before 6.x-1.1). Root cause: these modules do not sufficiently sanitize user-defined smiley acronyms, enabling XSS when an attacker with the administer smiley permission injects arbitrary script/...

CVE-2012-2724

The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page...

CVE-2012-2714

The BrowserID Mozilla Persona module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifier...

Design/Logic Flaw

The Simplenews module 6.x-1.x before 6.x-1.4, 6.x-2.x before 6.x-2.0-alpha4, and 7.x-1.x before 7.x-1.0-rc1 for Drupal reveals the email addresses of new mailing list subscribers when confirmation is required, which allows remote attackers to obtain sensitive information via the confirmation page...

Authentication flaw

The BrowserID Mozilla Persona module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifier...

CVE-2012-2714

The CVE-2012-2714 entry concerns the Drupal BrowserID (Mozilla Persona) module for Drupal 7.x-1.x, vulnerable before 7.x-1.3. The underlying issue is insufficient validation of authentication requests, allowing remote attackers to hijack arbitrary user authentication via the audience identifier. ...

CVE-2012-2714

The BrowserID Mozilla Persona module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users via the audience identifier...