14437 matches found
CVE-2015-4391
Cross-site request forgery CSRF vulnerability in the CiviCRM private report module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of users for requests that delete reports via unspecified vectors...
CVE-2015-4385
Cross-site scripting XSS vulnerability in unspecified administration pages in the Imagefield Info module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "Administer image styles" permission to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-4379
Cross-site request forgery CSRF vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors...
CVE-2015-4377
Cross-site scripting XSS vulnerability in unspecified administration pages in the Petition module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users with the "create petition" permission to inject arbitrary web script or HTML via unknown vectors...
CVE-2015-4378
Cross-site scripting XSS vulnerability in the Crumbs module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "Administer Crumbs" permission to inject arbitrary web script or HTML via a custom breadcrumb separator...
CVE-2015-4373
Cross-site scripting XSS vulnerability in the OG tabs module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via vectors related to nodes posted in an Organic Groups group...
CVE-2015-4397
Cross-site request forgery CSRF vulnerability in the Node Template module for Drupal allows remote attackers to hijack the authentication of users with the "access node template" permission for requests that delete node templates via unspecified vectors...
CVE-2015-4371
CVE-2015-4371 affects the Drupal Perfecto module (7.x) prior to 7.x-1.2. The vulnerability is an open redirect: an attacker can craft a URL parameter to redirect users to an attacker-controlled site, enabling phishing. Impact: credential/phishing risk for users visiting affected pages. Affected c...
CVE-2015-4377
CVE-2015-4377 describes a Cross-site scripting (XSS) vulnerability in the Drupal Petition module (6.x-1.x) prior to 6.x-1.3. The issue affects the module’s administration pages and can be triggered by remote authenticated users who have the create petition permission, allowing injection of arbitr...
CVE-2015-4397
CVE-2015-4397 describes a Cross-Site Request Forgery (CSRF) in the Drupal Node Template module. The vulnerability allows an attacker to hijack the authentication of users who have the access node template permission to delete node templates, via requests triggered from the user's browser (vectors...
CVE-2015-4352
The CVE-2015-4352 entry concerns the Drupal Spider Video Player module. Multiple sources confirm a CSRF vulnerability that can cause an administrator’s authenticated session to be used to delete videos via specially crafted requests (vectors not specified). Impact is limited to admin actions like...
CVE-2015-4391
Summary: The CVE-2015-4391 vulnerability affects the Drupal CiviCRM private report module, specifically 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3. The root cause is CSRF in the private report module that allows remote attackers to hijack a user’s session to delete reports via crafted ...
CVE-2015-4376
The CVE-2015-4376 entry affects the Drupal Profile2 Privacy module (7.x-1.x) prior to 7.x-1.5. The vulnerability is an XSS flaw due to insufficient sanitization in the module, exploitable by remote authenticated users who have the Administer Profile2 Privacy Levels permission. The vectors are not...
CVE-2015-4358
The vulnerability CVE-2015-4358 affects Ubercart Discount Coupons module for Drupal 6.x-1.x prior to 6.x-1.8. The issue is an XSS in unspecified administration pages due to insufficient sanitization of user-supplied text, exploitable by remote authenticated users with certain permissions to injec...
CVE-2015-4392
CVE-2015-4392 describes an XSS vulnerability in the Drupal Display Suite module for version 7.x-2.7. The issue allows remote authenticated users to inject arbitrary script/HTML via field display settings. The root cause is improper sanitization in Display Suite 7.x-2.7. Mitigation: upgrade to Dis...
CVE-2015-4381
Cross-site scripting XSS vulnerability in the Invoice module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "Administer own invoices" permission to inject arbitrary web script or HTML via unspecified vectors involving nodes of the "Invoice"...
CVE-2015-4345
The RESTWS Basic Auth submodule in the RESTful Web Services module 7.x-1.x before 7.x-1.5 and 7.x-2.x before 7.x-2.3 for Drupal caches pages for authenticated requests, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2015-4395
The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the...
CVE-2015-4359
Multiple cross-site scripting XSS vulnerabilities in the Registration codes module before 6.x-1.6, 6.x-2.x before 6.x-2.8, and 7.x-1.x before 7.x-1.2 for Drupal allow remote authenticated users with permission to create or edit taxonomy terms or nodes to inject arbitrary web script or HTML via...