CVE-2015-4347

CVE-2015-4347 describes a cross-site scripting (XSS) vulnerability in Drupal’s inLinks Integration module. The issue arises from insufficient sanitization of user input in some path arguments, allowing remote attackers to inject arbitrary web script or HTML. The advisory indicates the vulnerabili...

CVE-2015-4355

Cross-site request forgery CSRF vulnerability in the Watchdog Aggregator module for Drupal allows remote attackers to hijack the authentication of administrators for requests that enable or disable monitoring sites via unspecified vectors...

CVE-2015-4349

CVE-2015-4349 affects the Drupal Spider Contacts module. It is a Cross-Site Request Forgery (CSRF) vulnerability that enables an attacker to hijack administrator actions for requests that delete contact categories. The issue is tied to the Spider Contacts module (not Drupal core) and is mitigated...

CVE-2015-4380

Cross-site scripting XSS vulnerability in the Linear Case module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4366

Cross-site scripting XSS vulnerability in the Mover module 6.x-1.0 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4379

CVE-2015-4379 affects the Drupal Webform Multiple File Upload module (versions 6.x-1.x prior to 6.x-1.3 and 7.x-1.x prior to 7.x-1.3). The underlying issue is a CSRF vulnerability that allows remote attackers to hijack the authentication of certain users to perform file-deletion actions via unspe...

CVE-2015-4346

The CVE-2015-4346 entry describes a Cross-site scripting (XSS) vulnerability in Drupal’s SMS Framework module (6.x-1.x) prior to 6.x-1.1 when the Send to phone submodule is enabled. The root cause is insufficient sanitization of user-supplied text in message previews, allowing remote attackers to...

CVE-2015-4353

The CVE-2015-4353 entry concerns Drupal’s Custom Sitemap contributed module, which is vulnerable to Cross-Site Request Forgery (CSRF). The issue allows an attacker to induce an administrator’s browser to perform actions that delete sitemaps, effectively hijacking admin actions via CSRF. Affected ...

CVE-2015-4350

The CVE-2015-4350 entry concerns Drupal’s Spider Catalog contributed module, which has CSRF vulnerabilities. The root cause is insufficient CSRF protection on certain URLs, allowing remote attackers to trigger administrator actions that delete products, ratings, or categories. The issue is tied t...

CVE-2015-4372

Cross-site scripting XSS vulnerability in the Image Title module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4384

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4371

Open redirect vulnerability in the Perfecto module before 7.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in an unspecified parameter...

CVE-2015-4396

CVE-2015-4396 affects Drupal Keyword Research module (6.x-1.x) prior to 6.x-1.2. Root cause: CSRF vulnerabilities allow remote attackers to hijack the authentication of users with the kwak research admin site keywords permission, enabling actions that create, delete, or set priorities on keywords...

CVE-2015-4344

The CVE-2015-4344 entry concerns the Drupal Services Basic Authentication module (Drupal 7.x, versions prior to 7.x-1.3). The root cause is an access-bypass vulnerability related to page caching that could allow remote attackers to bypass intended resource restrictions. Public sources in the conn...

CVE-2015-4364

Multiple cross-site request forgery CSRF vulnerabilities in includes/campaignmonitorlists.admin.inc in the Campaign Monitor module 7.x-1.0 for Drupal allow remote attackers to hijack the authentication of users for requests that 1 enable list subscriptions via a request to...

CVE-2015-4345

CVE-2015-4345 affects Drupal's RESTful Web Services RESTWS module (Drupal 7.x). The vulnerability is in the Basic Auth submodule: RESTWS 7.x-1.x versions before 7.x-1.5 and 7.x-2.x before 7.x-2.3 cache pages for authenticated requests, which can lead to information disclosure of potentially sensi...

CVE-2015-4359

The vulnerability CVE-2015-4359 affects the Drupal Registration codes module. Affected are 6.x-1.x prior to 6.x-1.6, 6.x-2.x prior to 6.x-2.8, and 7.x-1.x prior to 7.x-1.2. The issue is cross-site scripting (XSS) where remote authenticated users with permission to create or edit taxonomy terms or...

CVE-2015-4360

CVE-2015-4360 is a CSRF vulnerability in the Drupal contributed module Registration codes affecting 6.x-1.x before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2. The underlying issue allows remote attackers to hijack administrator authentication for requests that delete role-rules (...

CVE-2015-4363

CVE-2015-4363 is an open redirect vulnerability in the Finder module for Drupal, exploitable via the function finder_form_goto which allows phishing by redirecting users to arbitrary URLs. Affected are Finder 6.x-1.x (Drupal 6) and Finder module 7.x-x.x prior to 7.x-2.1 (Drupal 7). The Drupal SA-...

CVE-2015-4358

Cross-site scripting XSS vulnerability in unspecified administration pages in the Ubercart Discount Coupons module 6.x-1.x before 6.x-1.8 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to taxonomy terms...