Cross site scripting

Cross-site scripting XSS vulnerability in the Spotlight module 7.x-1.x before 7.x-1.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title...

CVE-2015-6807

Cross-site scripting XSS vulnerability in the Mass Contact module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer mass contact" permission to inject arbitrary web script or HTML via a category label...

CVE-2015-6807

CVE-2015-6807 affects the Drupal Mass Contact contributed module (versions 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.1). The vulnerability is a cross-site scripting (XSS) flaw that allows remote authenticated users who have the "administer mass contact" permission to inject arbitrary script...

CVE-2015-6808

The CVE-2015-6808 issue affects the Drupal Spotlight module for 7.x-1.x, specifically versions prior to 7.x-1.5. It is a Cross-site Scripting (XSS) vulnerability that allows remote authenticated users with certain permissions to inject arbitrary script or HTML via a node title. The root cause rel...

Zendesk Feedback Tab - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-143

This module enables you to easily integrate the Zendesk Support Tab on your Drupal website. The module allows Javascript code to be embedded via its administration interface, allowing for the potential of cross-site scripting attacks. The module did not properly indicate that site administrators...

Fieldable Panels Panes - Less Critical - Access bypass - SA-CONTRIB-2015-145

Fieldable Panels Panes enables you to create custom panes for embedding in Panels-based displays Page Manager, Panelizer, Panels Everywhere via a fieldable custom entity type. The module doesn't sufficiently check for permission to edit existing Fieldable Panels Panes entities, thus allowing...

Mass Contact - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-144

This module allows anyone with permission to send a single message to multiple users of a site, using the site's roles and/or taxonomy functionality. The module doesn't sufficiently sanitize the category labels when they are displayed. This vulnerability is mitigated by the fact that an attacker...

Drupal Quick Edit Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Quick Edit module in versions 7.x-1.x prior to 7.x-1.2. A remote attacker can exploit this vulnerability to injec...

Drupal up to 7.38 Ajax Handler a Tag cross site scripting

No description provided by source...

Spotlight - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2015-142

The Spotlight module provides a tool that mimics Mac OS X Spotlight functionality. It provides faster access to content, paths and uploaded files. The module doesn't sufficiently sanitize node titles when displayed in results. This vulnerability is mitigated by the fact that an attacker must have...

CVE-2015-6754

Cross-site scripting XSS vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6753

Multiple cross-site scripting XSS vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 entity title, related to in-place editing, or a 2 node title...

Cross site scripting

Cross-site scripting XSS vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 entity title, related to in-place editing, or a 2 node title...

CVE-2015-6753

Multiple cross-site scripting XSS vulnerabilities in the Quick Edit module 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via an 1 entity title, related to in-place editing, or a 2 node title...

CVE-2015-6753

Drupal Quick Edit module (7.x-1.x) contains XSS vulnerabilities in versions prior to 7.x-1.2. The issue allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via an entity title (in-place editing) or a node title. Affected software is Quick Edit 7.x-1.x...

CVE-2015-6754

CVE-2015-6754 affects the Drupal Path Breadcrumbs module (7.x-3.x) prior to 7.x-3.3. The root cause is insufficient input filtering in the module’s administration interface, enabling remote authenticated users with the Administer Path Breadcrumbs permission to inject arbitrary web script or HTML....

CVE-2015-6754

Cross-site scripting XSS vulnerability in the administration interface in the Path Breadcrumbs module 7.x-3.x before 7.x-3.3 for Drupal allows remote authenticated users with the "Administer Path Breadcrumbs" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-6752

Cross-site scripting XSS vulnerability in the Search API Autocomplete module 7.x-1.x before 7.x-1.3 for Drupal, when the search index is configured to use the HTML filter processor, allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified...

CVE-2015-6751

Multiple cross-site scripting XSS vulnerabilities in the Time Tracker module 7.x-1.x before 7.x-1.4 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via a 1 note added to a time entry or an 2 activity used to categorize time tracker entri...