Code injection

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission...

CVE-2015-7304

Cross-site scripting XSS vulnerability in the amoCRM module 7.x-1.x before 7.x-1.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data...

CVE-2015-7305

The vulnerability CVE-2015-7305 affects the Drupal Scald module (Scald 7.x-1.x) prior to 7.x-1.5, where a misconfiguration allows remote attackers to obtain sensitive atom property information via a debug context, bypassing field restrictions. Affected software is the Scald: Media Management made...

CVE-2015-7306

The CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal does not properly check access permissions, which allows remote authenticated users to access and change settings by leveraging the "access administration pages" permission...

CVE-2015-7307

Cross-site scripting XSS vulnerability in the CMS Updater module 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving the configuration page...

CVE-2015-7305

The Scald module 7.x-1.x before 7.x-1.5 for Drupal does not properly restrict access to fields, which allows remote attackers to obtain sensitive atom property information via vectors involving a "debug context."...

CVE-2015-7304

CVE-2015-7304 affects the Drupal amoCRM module (7.x-1.x) prior to 7.x-1.2. The vulnerability is a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified HTTP POST data due to improper input handling. Impact is limited to affected amoCRM...

CVE-2015-7307

The CVE-2015-7307 entry describes a cross-site scripting (XSS) vulnerability in the Drupal CMS Updater module (7.x-1.x) prior to version 7.x-1.3. The issue arises on the module’s configuration page where user-supplied text is not properly sanitized, enabling remote attackers to inject arbitrary w...

CVE-2015-7306

Summary: CVE-2015-7306 affects the Drupal CMS Updater module (7.x-1.x) prior to 7.x-1.3. The vulnerability is a permission check bypass on the settings access page, enabling remote authenticated users to view and modify settings by abusing the "access administration pages" permission. Affected so...

Drupal OSF Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in the Drupal OSF module when the OSF Ontology and OSF Import modules are enabled in the program, which allows remote attackers to construct malicious URIs, trick users...

Drupal Twitter Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP. The Drupal Twitter module failed to properly check access permissions, allowing a remote attacker to post tweets to arbitrary accounts with the 'post to twitter' permission...

Drupal Fieldable Panels Panes module security bypass vulnerability

Drupal is a free and open source content management system developed in PHP. Drupal Fieldable Panels Panes fails to check the edit permissions of Fieldable Panels Panes entities, allowing remote attackers to edit panes with the permissions of the edit panel...

Drupal RESTful Module Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP. The Drupal RESTful module fails to properly cache pages for authenticated users, allowing remote attackers to exploit the vulnerability to obtain sensitive information...

Drupal OSF Module Arbitrary File Deletion Vulnerability

Drupal is a free and open source content management system developed in PHP. A security vulnerability exists in the Drupal OSF module, which can be exploited by remote attackers to delete arbitrary files when the OSF Ontology and OSF Import modules are enabled in the program...

CVE-2015-7234

The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors...

CVE-2015-7233

Cross-site request forgery CSRF vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors...

CVE-2015-7232

Cross-site scripting XSS vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-7231

The Commerce Commonwealth CBA module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."...

CVE-2015-7230

The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions to bypass node and field validation by saving a node...

CVE-2015-7229

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...