CVE-2015-5493

The Entityform Block module 7.x-1.x before 7.x-1.3 for Drupal does not properly check permissions when a form is locked to a role, which allows remote attackers to obtain access to certain entityforms via unspecified vectors...

CVE-2015-5499

The Drupal Navigate module has insufficient permission checks, allowing remote authenticated users to modify custom widgets and create widget records by exploiting the navigate view permission. CVSSv2 base score 4.0 (Medium). No remediation/version details are provided in the supplied documents.

CVE-2015-5511

The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login...

CVE-2015-5501

The CVE covers Drupal’s Hostmaster (Aegir) module (6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2). The underlying issue allows remote attackers to execute arbitrary PHP code by placing a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site envi...

CVE-2015-5500

CVE-2015-5500 is an XSS vulnerability in Drupal’s Navigate module. Public records describe a cross-site scripting flaw that allows remote authenticated users with specific permissions to inject arbitrary script or HTML via unspecified vectors. The available documents identify the affected compone...

CVE-2015-5504

SQL injection vulnerability in the Novalnet Payment Module Ubercart module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5491

CVE-2015-5491 concerns the Drupal module Dynamic display block (7.x-1.x) , where versions prior to 7.x-1.1 allow remote authenticated users with the administer ddblock permission to bypass access restrictions and read titles of restricted content. The root cause is improper access control in the ...

CVE-2015-5490

The CVE-2015-5490 vulnerability affects the Drupal Views module (7.x-3.x) specifically versions 7.x-3.5 through 7.x-3.10. The root cause is that _views_fetch_data in includes/cache.inc does not rebuild the full cache when the static cache is non-empty, allowing remote attackers to bypass configur...

CVE-2015-5511

The vulnerability CVE-2015-5511 affects the HybridAuth Social Login module for Drupal 7.x-2.x, specifically versions prior to 7.x-2.13. The issue allows remote attackers to bypass the site’s “administrator only” user registration configuration and create accounts via social login. The root cause ...

CVE-2015-5487

Cross-site scripting XSS vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x before 7.x-1.3 for Drupal allows remote authenticated users with the "view meta information" permission to inject arbitrary web script or HTML via unspecified vectors related to the meta access...

CVE-2015-5497

The CVE-2015-5497 issue affects Drupal’s Web Links module (Drupal 6.x-2.x family and Drupal 7.x-1.x family). The vulnerability is an XSS that occurs due to insufficient sanitization in the Web Links module, allowing remote authenticated users with certain permissions to inject arbitrary web scrip...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Time Tracker Module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Time Tracker is one of the time tracking system modules. The Drupal Time Tracker module has multiple cross-site scripting vulnerabilities that can be exploited by attackers to cause the...

Drupal Compass Rose Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Compass Rose is one of the direction compass modules. A cross-site scripting vulnerability exists in version 6.x-1.0 of the Drupal Compass Rose module, which can be exploited by an...

Drupal Commerce Commonwealth module authentication bypass vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. commerce Commonwealth is one of the modules that integrates the Commonwealth Bank of Australia CBA into the Drupal e-commerce payment and settlement system. An authentication bypass...

http-drupal-enum NSE Script

Enumerates the installed Drupal modules/themes by using a list of known modules and themes. The script works by iterating over module/theme names and requesting MODULEPATH/MODULENAME/LICENSE.txt for modules and THEMEPATH/THEMENAME/LICENSE.txt. MODULEPATH/THEMEPATH which is either provided by the...

[SECURITY] Fedora 21 Update: drupal6-cck-2.10-1.fc21

The Content Construction Kit allows you to add custom fields to custom content types using a web interface. In Drupal 5.x, custom content types can be created in Drupal core, and the Content Construction Kit allows you to add custom fields to any content type. In Drupal 7 and later, most of the...

[SECURITY] Fedora 22 Update: drupal6-cck-2.10-1.fc22

The Content Construction Kit allows you to add custom fields to custom content types using a web interface. In Drupal 5.x, custom content types can be created in Drupal core, and the Content Construction Kit allows you to add custom fields to any content type. In Drupal 7 and later, most of the...

Compass Rose - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-138

Compass Rose module provides a type of CCK field that allows to represent the most common orientations North, North-East, East, South-East, South, South-West, West and North-West. The module was embedding a JavaScript library from an external source that was not reliable, thereby exposing the sit...

Commerce Commonwealth (CBA) - Moderately Critical - Insufficient Verification of API Data - SA-CONTRIB-2015-136

This module enables you to pay for items on Drupal Commerce, using Commerce Commonwealth payment gateway. The module doesn't sufficiently validate the payment under certain specific scenarios. A malicious user can modify the urls used in gateway interaction with Commbank to make a failed payment...

Quick Edit - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-137

This module enables you to in-place edit entities' fields. The module doesn't sufficiently filter entity titles under the scenario where the user starts in-place editing an entity. The module also doesn't sufficiently filter node titles under the scenario where a node is displayed albeit only on...