CVE-2015-7227

The CVE-2015-7227 entry affects the Drupal Fieldable Panels Panes module (7.x-1.x) prior to 7.x-1.7. The underlying issue is improper permission checks when editing Fieldable Panels Panes entities, allowing remote authenticated users with general edit permissions to modify panes. Impact is limite...

CVE-2015-7234

The OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology and OSF Import modules are enabled, allows user-assisted remote attackers to delete arbitrary files via unspecified vectors...

CVE-2015-7231

The Drupal Commerce Commonwealth (CBA) module for Drupal 7.x-1.x is affected by an input validation flaw in payment processing. Specifically, versions prior to 7.x-1.5 do not sufficiently validate gateway interactions, allowing a remote attacker to craft a URL that makes a failed payment appear v...

CVE-2015-7231

The Commerce Commonwealth CBA module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."...

CVE-2015-7232

The CVE-2015-7232 issue affects the OSF for Drupal module (Drupal 7.x) specifically in the 7.x-3.x line prior to 7.x-3.1, when the OSF Ontology module is enabled. The vulnerability is a Cross-Site Scripting (XSS) in unspecified administration pages, allowing remote attackers to inject arbitrary s...

CVE-2015-7233

CVE-2015-7233 describes a CSRF vulnerability in the Drupal OSF module (7.x-3.x) before 7.x-3.1 when the OSF Import module is enabled. The issue allows remote attackers to hijack an administrator’s authenticated session to create new OSF datasets via unspecified vectors. Affected component is the ...

CVE-2015-7233

Cross-site request forgery CSRF vulnerability in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Import module is enabled, allows remote attackers to hijack the authentication of administrators for requests that create new OSF datasets via unspecified vectors...

CVE-2015-7232

Cross-site scripting XSS vulnerability in unspecified administration pages in the OSF module 7.x-3.x before 7.x-3.1 for Drupal, when the OSF Ontology module is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-7229

The Twitter module 6.x-5.x before 6.x-5.2, 7.x-5.x before 7.x-5.9, and 7.x-6.x before 7.x-6.0 for Drupal does not properly check access permissions, which allows remote authenticated users to post tweets to arbitrary accounts by leveraging the 1 "post to twitter" permission or change the options...

CVE-2015-7230

The Workbench Email module 7.x-3.x before 7.x-3.4 for Drupal allows remote authenticated users with certain permissions to bypass node and field validation by saving a node...

CVE-2015-7227

The Fieldable Panels Panes module 7.x-1.x before 7.x-1.7 for Drupal does not properly check permissions to edit Fieldable Panels Panes entities, which allows remote authenticated users to edit panes by leveraging permissions to edit panels...

CVE-2015-7228

The CVE-2015-7228 issue affects Drupal’s RESTful module (7.x-1.x) prior to 7.x-1.3. The vulnerability arises because the RESTful module does not properly cache pages for authenticated users when using non-cookie authentication providers, which can allow remote attackers to obtain sensitive inform...

CMS Updater - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2015-150

CMS Updater allows to update Drupal core automatically with a subscription service. Access bypass The module does not sufficiently protect the settings page allowing any user with the permission "access administration pages" to change settings. This vulnerability is mitigated by the fact that an...

Drupal 7 driver for SQL Server and SQL Azure - Moderately Critical - SQL Injection - SA-CONTRIB-2015-148

Drupal 7 driver for SQL Server and SQL Azure module has a SQL injection vulnerability. Certain characters aren't properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search. Only sites that use contrib or cust...

amoCRM - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2015-149

This module enables you to integrate with amoCRM service using webhooks. The module does not sufficiently sanitize the logged data when malicious POST data is received. This vulnerability is mitigated by the fact that a module such "Database logging" dblog must be enabled which displays log...

Scald - Moderately Critical - Information Disclosure - SA-CONTRIB-2015-151

This module enables you to easily manage your media assets and re-use them in all your content. The module provided a "debug" context that gave access to all the atom properties, including all the fields attached to this atom, without applying the corresponding field restrictions. This...

Drupal Zendesk Feedback Tab Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Zendesk Feedback Tab module in versions 7.x-1.1 and prior to 7.x-1.x, which can be exploited by a remote attacker...

CVE-2015-6921

Cross-site scripting XSS vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Zendesk Feedback Tab module 7.x-1.x before 7.x-1.1 for Drupal allows remote administrators with the "Configure Zendesk Feedback Tab" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6921

The CVE-2015-6921 vulnerability affects the Drupal Zendesk Feedback Tab module (7.x-1.x) prior to 7.x-1.1. The issue is a cross-site scripting (XSS) flaw that allows users with the Configure Zendesk Feedback Tab permission (remote administrators) to inject arbitrary web scripts or HTML via unspec...