Open Atrium - Moderately Critical - Access Bypass - SA-CONTRIB-2016-003

Open Atrium allows you to control access via a hierarchy of public and private spaces and sub-spaces. If a public sub-space is created within a private parent-space, the content nodes of the public sub-space are accessible to users who are not members of the parent private space. This issue only...

Drupal RedHen CRM Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.RedHen CRM is one of the CRM modules. A cross-site scripting vulnerability exists in Drupal RedHen CRM, which allows remote attackers to exploit the vulnerability to inject malicious...

CVE-2016-1913

Multiple cross-site scripting XSS vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated users with certain access to inject arbitrary web script or HTML via unspecified vectors, related to 1 individual contacts, 2 notes, or 3 engagement scores...

CVE-2016-1913

Multiple cross-site scripting XSS vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated users with certain access to inject arbitrary web script or HTML via unspecified vectors, related to 1 individual contacts, 2 notes, or 3 engagement scores...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated users with certain access to inject arbitrary web script or HTML via unspecified vectors, related to 1 individual contacts, 2 notes, or 3 engagement scores...

CVE-2016-1913

CVE-2016-1913 concerns the Redhen CRM module for Drupal 7.x, where versions prior to 7.x-1.11 are vulnerable to cross-site scripting (XSS). The vulnerabilities affect rendering paths for individual contacts, notes, and engagement scores, arising from insufficient input filtering before display an...

CVE-2016-1913

Multiple cross-site scripting XSS vulnerabilities in the Redhen module 7.x-1.x before 7.x-1.11 for Drupal allow remote authenticated users with certain access to inject arbitrary web script or HTML via unspecified vectors, related to 1 individual contacts, 2 notes, or 3 engagement scores...

Drupal Field Group Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Field Group is one of the modules used to group fields. A cross-site scripting vulnerability exists in Drupal Field Group, which can be exploited by remote attackers to inject malicious...

RedHen CRM - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-002

The Redhen set of modules allows you to build a CRM features in a Drupal site. When rendering individual Contacts, this module does not properly filter the certain data prior to display. When rendering listing of notes or engagement scores, these modules do not properly filter certain data before...

Drupal Mollom Module Security Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Mollom is one of the intelligent content review third-party service modules. A security vulnerability exists in the Drupal Mollom module version 6.x-2.15 prior to version 6.x-2.7. A...

CVE-2016-1565

Cross-site scripting XSS vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute...

CVE-2016-1565

Cross-site scripting XSS vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute...

Cross site scripting

Cross-site scripting XSS vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute...

CVE-2016-1565

Cross-site scripting XSS vulnerability in the Field Group module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with permission to configure field display settings to inject arbitrary web script or HTML via an element attribute...

CVE-2016-1565

An XSS vulnerability (CVE-2016-1565) affects the Drupal Field Group module for Drupal 7.x: versions prior to 7.x-1.5; remote authenticated users with permission to configure field display settings can inject script/HTML via an element attribute. Drupal core is not affected. Remediation: upgrade F...

CVE-2015-8761

The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import...

CVE-2015-8754

The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors...

Design/Logic Flaw

The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom blacklist via unspecified vectors...

Design/Logic Flaw

The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import value sets" permission to execute arbitrary PHP code via the exported values list in a ctools import...

CVE-2015-8754

The vulnerability CVE-2015-8754 affects the Drupal Mollom module in versions 6.x-2.7 through 6.x-2.14, where insufficient access checks allow remote attackers to bypass access restrictions and modify the site-wide mollom blacklist. The issue arises when handling blacklist entries, enabling unauth...