CVE-2015-4375

The Chaos tool suite ctools module 7.x-1.x before 7.x-1.7 for Drupal allows remote attackers to obtain sensitive node titles via 1 an autocomplete search on custom entities without an access query tag or 2 leveraging knowledge of the ID of an entity...

CVE-2015-4393

The CVE-2015-4393 entry relates to Drupal Services module (7.x-3.x) vulnerability prior to 7.x-3.12. The resource/endpoint used for uploading files could be triggered by remote authenticated users who have the Save file information permission to execute arbitrary code via a crafted filename. Affe...

CVE-2015-4363

Open redirect vulnerability in the finderformgoto function in the Finder module for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors...

CVE-2015-4365

CVE-2015-4365 affects the Drupal contributed module Taxonomy Accordion . The underlying issue is insufficient sanitization of user-submitted text in taxonomy term-related pages, enabling a Cross-Site Scripting (XSS) vulnerability. The advisory indicates that remote authenticated users with certai...

CVE-2015-4372

The Drupal Image Title module (7.x-1.x, prior to 7.x-1.1) contains a cross-site scripting (XSS) vulnerability that allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. The underlying issue is insufficient sanitization of user-s...

CVE-2015-4347

Cross-site scripting XSS vulnerability in the inLinks Integration module for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified path arguments...

CVE-2015-4381

The CVE-2015-4381 entry affects the Drupal Invoice contributed module (versions 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3). The issue is a Cross-Site Scripting (XSS) vulnerability that can be exploited by remote authenticated users who have the "Administer own invoices" permission to inje...

CVE-2015-4361

Cross-site request forgery CSRF vulnerability in the Registration codes module before 6.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete registration codes via unspecified vectors...

CVE-2015-4366

CVE-2015-4366 affects Drupal’s contributed Mover module (6.x-1.0). The issue stems from insufficient sanitization of user-supplied text in certain pages, enabling Cross-Site Scripting (XSS) by remote authenticated users who have permissions to create/edit nodes. No exploit details provided beyond...

CVE-2015-4389

The Open Graph Importer ogtagimporter 7.x-1.x for Drupal does not properly check the create permission for content types created during import, which allows remote authenticated users to bypass intended restrictions by leveraging the "import ogtagimporter" permission...

CVE-2015-4362

Cross-site request forgery CSRF vulnerability in trackingcode.admin.inc in the Tracking Code module 7.x-1.x before 7.x-1.6 for Drupal allows remote attackers to hijack the authentication of administrators for requests that disable tracking codes via unspecified vectors...

CVE-2015-4351

CVE-2015-4351 affects the Drupal Spider Video Player module. Remote authenticated users with the access Spider Video Player administration permission could delete arbitrary files via a crafted URL. The issue stems from insufficient validation of delete requests (and related CSRF protections) in t...

CVE-2015-4394

The CVE-2015-4394 issue affects the Drupal Services module (7.x-3.x) prior to 7.x-3.12, where an improper field_access check allows remote attackers to disclose private field information. The vulnerability is tied to the Services module’s handling of entity field access, enabling information expo...

CVE-2015-4376

The CVE-2015-4376 entry affects the Drupal Profile2 Privacy module (7.x-1.x) prior to 7.x-1.5. The vulnerability is an XSS flaw due to insufficient sanitization in the module, exploitable by remote authenticated users who have the Administer Profile2 Privacy Levels permission. The vectors are not...

CVE-2015-4368

CVE-2015-4368 affects the Drupal Commerce Ogone module (7.x-1.x) prior to 7.x-1.5. The vulnerability allows malicious users to bypass the payment step and complete the checkout without a payment being processed, via unspecified vectors described in the advisory and CVE records. The root cause is ...

Drupal Novalnet Payment - Ubercart Module SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP.Novalnet Payment is a payment module. A SQL injection vulnerability exists in the Drupal Novalnet Payment - Ubercart module due to the program failing to adequately filter user-supplied input. The vulnerability allows...

Drupal Novalnet Payment Module SQL Injection Vulnerability

Drupal is a free and open source content management system developed in PHP.Novalnet Payment is a payment module. Drupal Novalnet Payment has a SQL injection vulnerability due to the program failing to adequately filter user-supplied input. The vulnerability allows remote attackers to submit...

Drupal Chamilo integration module open redirection vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Chamilo integration is one of the modules that integrates with the Chamilo LMS learning management system and provides a way to view Chamilo resources in Drupal blocks. An open...

Drupal Storage API Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Storage API is one of the framework modules for managing file storage and serving. An access bypass vulnerability exists in the Drupal Storage API module. An attacker can exploit this...

Novalnet Payment Module Ubercart - Critical - SQL Injection - Unsupported - SA-CONTRIB-2015-116

This module enables you add the Novalnet payment service provider to Ubercart. The module fails to sanitize a database query by not using the database API properly, thereby leading to a SQL Injection vulnerability. Since the affected path is not protected against CSRF, a malicious user can exploi...