Novalnet Payment Module Drupal Commerce - Critical - SQL Injection - Unsupported - SA-CONTRIB-2015-117

This module enables you add the Novalnet payment service provider to Drupal Commerce. The module fails to sanitize a database query by not using the database API properly, thereby leading to a SQL Injection vulnerability. Since the affected path is not protected against CSRF, a malicious user can...

Storage API - Moderately Critical - Access Bypass - SA-CONTRIB-2015-114

The Storage API module creates an underlying agnostic storage layer for Drupal using many different underlying storage methods. Storage API can be used to create fields for entities to hold data. The module failed to restrict access to the Storage API fields attached to entities that are not node...

Chamilo integration - Less Critical - Open Redirect - SA-CONTRIB-2015-115

Chamilo integration module integrates Drupal with Chamilo LMS. The module has an Open Redirect vulnerability, it doesn't sufficiently check passed parameters in the URL. An attacker could trick users to visit malicious sites without realizing it. CVE identifiers issued CVE-2015-5503 Versions...

Drupal pass2pdf module information leakage vulnerability

Drupal is a free, open source content management system developed in PHP. pass2pdf is a module that sends website registration passwords to users in PDF file format. Drupal pass2pdf has a security vulnerability that allows remote attackers to exploit the vulnerability to submit special requests t...

Drupal Navigate module cross-site scripting vulnerability

Drupal is a free, open-source content management system developed in the PHP language.Navigate is one of the customizable navigation modules that supports rapid deployment. A cross-site scripting vulnerability exists in the Drupal Navigate module, which allows remote attackers to exploit the...

Drupal Navigate Module Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language.Navigate is one of the customizable navigation modules that supports rapid deployment. A security bypass vulnerability exists in the Drupal Navigate module that allows remote attackers to submit special requests...

Drupal Shipwire Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP language.Shipwire is a distribution query module. A cross-site scripting vulnerability exists in the Drupal Shipwire module, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML...

Drupal Web Links Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. web Links is one of the web link modules. A cross-site scripting vulnerability exists in the Drupal Navigate module, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, whi...

Drupal Hostmaster Module Remote Code Execution Vulnerability

Drupal is a free and open source content management system developed in PHP. A security vulnerability exists in the Drupal Hostmaster module that allows remote attackers to exploit the vulnerability to submit special requests and execute arbitrary code...

Drupal Services Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Services is one of the modules that allows users to programmatically create customized Web service items. An information disclosure vulnerability exists in the Drupal Services module...

Drupal Keyword Research Module Cross-Site Request Forgery Vulnerability

Drupal is an open source content management system.Keyword Research is a module that provides keywords for searches. A cross-site request forgery vulnerability exists in the Drupal Keyword Research module that allows remote attackers to construct malicious URIs, trick users into parsing them, and...

Drupal HybridAuth Social Login Module Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP.HybridAuth Social Login is one of the modules that uses social network accounts to log in and register with the Drupal system. An information disclosure vulnerability exists in Drupal HybridAuth Social Login, which can be...

Drupal Linear Case Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Linear Case, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

Drupal CiviCRM private report module cross-site request forgery vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal CiviCRM private report, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform...

Drupal Webform Multiple File Upload Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site request forgery vulnerability exists in Drupal Webform Multiple File Upload, which allows remote attackers to construct malicious URIs, trick users into parsing them, and can target user contexts to perform...

Drupal Node Template Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language.Node Template is one of the modules that uses the structure and data of nodes as a template. A cross-site scripting vulnerability exists in the Drupal Node Template module, which allows remote attackers to explo...

Drupal Current Search Links Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Current Search Links, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive...

Web Links - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-110

The Web Links module provides a comprehensive way to manage url links to other websites. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permissio...

Drupal Ubercart Webform Checkout Pane Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Ubercart Webform Checkout Pane, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code that can be used to gain access to...

Drupal Crumbs Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in Drupal Crumbs, which allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to gain access to sensitive information ...