CVE-2015-6658

CVE-2015-6658 affects Drupal autocomplete: XSS via crafted URLs in the Autocomplete system. Affected: Drupal 6.x before 6.37 and 7.x before 7.39 (related to uploading files). Root cause: input handling in autocomplete leads to script/HTML injection. Impact: remote attacker can execute arbitrary s...

CVE-2015-6661

CVE-2015-6661 affects Drupal core: Drupal 6.x before 6.37 and 7.x before 7.39 are vulnerable. The issue allows remote attackers to obtain sensitive node titles by reading the site menu. The provided connected documents corroborate the vulnerability as part of Drupal core releases prior to the fix...

CVE-2015-6659

Removed by vendor...

CVE-2015-6660

Removed by vendor...

CVE-2015-6658

Cross-site scripting XSS vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files...

CVE-2015-6665

CVE-2015-6665 affects Drupal 7.x up to version 7.39 and the Ctools module 6.x up to 6.x-1.14. The XSS flaw resides in the Ajax handler, allowing remote attackers to inject arbitrary scripts/HTML via a whitelisted HTML element (potentially the A tag). Remediation: upgrade to Drupal 7.39 and Ctools...

CVE-2015-6659

Drupal 7.x contains a SQL injection vulnerability in the SQL comment filtering system of the Drupal Database API, exploitable before 7.39. Remote attackers can execute arbitrary SQL via an SQL comment. A patch/update to Drupal 7.39 fixes this vulnerability; apply or upgrade to 7.39 or later. If p...

CVE-2015-6658

Removed by vendor...

CVE-2015-6661

Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu...

CVE-2015-6665

Cross-site scripting XSS vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the "a" tag...

CVE-2015-6660

The CVE-2015-6660 issue affects Drupal 6.x up to 6.37 and Drupal 7.x up to 7.39, where the Form API does not properly validate the form token. This enables CSRF attacks that can upload files to another user’s account via vectors related to file upload value callbacks. Root cause: insufficient for...

CVE-2015-6661

Removed by vendor...

CVE-2015-6665

Removed by vendor...

FreeBSD : drupal -- multiple vulnerabilities (9393213d-489b-11e5-b8c7-d050996490d0)

Drupal development team reports : This security advisory fixes multiple vulnerabilities. See below for a list. Cross-site Scripting - Ajax system - Drupal 7 A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax on a whitelisted HTM...

Drupal Ajax System Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Ajax System, which can be exploited by remote attackers to construct malicious URIs and trick users into parsing them, which can be used to obtain sensitive cookies,...

Drupal Form API Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. Drupal suffers from a cross-site request forgery vulnerability that allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform malicious actions...

Drupal SQL Comment Filtering System SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP. A SQL injection vulnerability exists in the Drupal SQL Comment Filtering System, which allows remote attackers to exploit the vulnerability to submit specially crafted SQL queries to manipulate or obtain database data...

Drupal Autocomplete System Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Autocomplete System, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

Drupal Ctools Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. ctools is one of the API modules used to improve the development experience. A cross-site scripting vulnerability exists in the Drupal Ctools module, which allows remote attackers to exploit the vulnerability to inject...

Drupal Menu Links Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP. A security vulnerability exists in Drupal Menu Links that allows remote attackers to exploit the vulnerability to submit special requests to obtain sensitive information...