14426 matches found
Select2 Field Widget - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-173
Select2 Field Widget module enables you to use the select2 library for field widgets. The module doesn't sufficiently sanitize some user supplied text, leading to a reflected Cross Site Scripting vulnerability XSS. CVE identifiers issued ACVE identifier will be requested, and added upon issuance,...
Drupal Encrypt Module Information Disclosure Vulnerability
Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Encrypt is one of the API modules used to perform bidirectional data encryption. A security vulnerability exists in the Drupal Encrypt module version 7.x-2.x prior to 7.x-2.2. An attack...
Values - Critical - Arbitrary PHP code execution - SA-CONTRIB-2015-172
This module enables you to create key|value pairs for use in list fields, webforms etc. The module includes an import page that runs eval on an exported code block ctools, but the permission for the page does not warn about security concerns of importing raw php code like this trusted permission...
Open Atrium - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-174
Open Atrium distribution enables you to create an intranet. Open Atrium Core module doesn't sufficiently sanitize some user supplied text, leading to a reflected Cross Site Scripting vulnerability XSS. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordanc...
http-vuln-cve2014-3704 NSE Script
Exploits CVE-2014-3704 also known as 'Drupageddon' in Drupal. Versions 7.32 of Drupal core are known to be affected. Vulnerability allows remote attackers to conduct SQL injection attacks via an array containing crafted keys. The script injects new Drupal administrator user via login form and the...
Apache Solr Search - Moderately Critical - Access Bypass - SA-CONTRIB-2015-170
This module enables you to connect to an Apache Solr search server to provide a replacement for Drupal core content search and provide both extra features and better search performance and relevance. The module doesn't correctly check access when attempting to delete non-default search...
Chat Room - Moderately Critical - Access Bypass - SA-CONTRIB-2015-169
Chat Room enables site owners to integrate chats into nodes by adding the chat room field to them. The module relies on a websocket connection to send chat messages to the client. The module doesn't sufficiently validate access before setting up the websocket. As a result, users may receive...
Token Insert Entity - Moderately Critical - Access bypass and information disclosure - SA-CONTRIB-2015-171
This module offers a WYSIWYG button to embed rendered entities in fields using a WYSIWYG normally the body of a node. There is a vulnerability because a user that can create or edit content and has the "insert entity token" permission can insert tokens relating to e.g. an unpublished node and all...
RESTful - Less Critical - Access bypass - SA-CONTRIB-2015-167
RESTful module allows Drupal to be operated via RESTful HTTP requests, using best practices for security, performance, and usability. The module doesn't sufficiently validate some user input. Specific code could be run arbitrarily by an attacker in certain circumstances. This vulnerability is...
Mollom - Critical - Access bypass - SA-CONTRIB-2015-168
The Mollom module allows users to protect their website from spam. As part of the spam protection, Mollom enables the website administrator to create a blacklist. When content is submitted that matches terms on the black list it will be automatically marked as spam and rejected per the site...
Drupal UC Profile模块信息泄露漏洞
No description provided by source...
Drupal MAYO主题跨站脚本漏洞
No description provided by source...
Drupal UC Profile Module Information Disclosure Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.UC Profile is one of the modules used to create and configure user profiles and files. An information disclosure vulnerability exists in the Drupal UC Profile module in versions 6.x-1.x...
Drupal MAYO theme cross-site scripting vulnerability
Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.MAYO theme is one of the modules that provides users with an easy way to define and create a theme of their choice. A cross-site scripting vulnerability exists in Drupal MAYO theme...
Drupal Webform CiviCRM Integration模块跨站脚本漏洞
No description provided by source...
Drupal Stickynote模块跨站脚本漏洞（CNVD-2015-07318）
No description provided by source...
Drupal User Dashboard模块SQL注入漏洞
No description provided by source...
Drupal Field as Block模块信息泄露漏洞（CNVD-2015-07619）
No description provided by source...