MailChimp - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-101

The MailChimp module allows you to create and manage mailing lists via MailChimp's API. The MailChimp Signup submodule does not properly sanitize some user input, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting XSS vulnerability. This vulnerability is...

Camtasia Relay - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-100

This module enables you to integrate your Drupal site with TechSmith Relay software. The module doesn't sufficiently sanitize user input under the meta access tab. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "view meta information". CVE...

Smart Trim - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-102

This module implements a new field formatter for textfields text, textlong, and textwithsummary, if you want to get technical that improves upon the "Summary or Trimmed" formatter built into Drupal 7. The module doesn't sufficiently filter user input via the field settings form. This vulnerabilit...

Multiple Open Redirect Vulnerabilities in Drupal Tadaa! module

Drupal Tadaa! module is a Drupal module that simplifies enabling or disabling modules and changing configurations when switching between environments. Multiple open redirection vulnerabilities exist in Drupal Tadaa! module versions prior to 7.x-1.4. This allows remote attackers to redirect users ...

Multiple Vulnerabilities in Drupal Certify

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access restriction and information disclosure vulnerability exists in Drupal Certify. Allow attackers to exploit this vulnerability to bypass security restrictions and...

Drupal Taxonews Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Taxonews is one of the modules that generates blocks containing titles for nodes in the taxonomy vocabulary by matching conditions. A cross-site scripting vulnerability exists in the...

Drupal Node basket module open redirection vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node basket is one of the modules that allows nodes to be selected from the current session store for payment operations. A security vulnerability exists in the Drupal Node basket modul...

Drupal Alfresco Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Alfresco is one of the enterprise content management system modules that integrates Drupal and Alfresco. A cross-site request forgery vulnerability exists in Drupal Alfresco module...

Unspecified Vulnerability in Drupal Amazon AWS Module

Drupal is a free, open source content management system developed in the PHP language maintained by the Drupal community.Amazon AWS is one of the modules that integrates with Amazon Web Services AWS. A security vulnerability exists in the Drupal Amazon AWS module prior to version 7.x-1.3, which...

Drupal Patterns Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Patterns is one of the modules that builds around bottlenecks by managing and automating site configurations stored in XML or YAML schema. A cross-site request forgery vulnerability...

Drupal Public Download Count Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Public Download Count module. This vulnerability allows attackers to inject arbitrary web script or HTML...

Drupal Node Invite Module Open Redirect Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node Invite is one of the modules that is similar to RSVP sending invitations via email. An open redirection vulnerability exists in the Drupal Node Invite module versions prior to...

Drupal Corner Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Corner is one of the website modification modules. A cross-site request forgery vulnerability exists in the Drupal Corner module. A remote attacker can exploit this vulnerability to...

Drupal Classified Ads Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Classified Ads is one of the modules that categorizes ads. A cross-site scripting vulnerability exists in the user management interface of the Drupal Classified Ads module in versions...

Drupal Node Invite Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node Invite is one of the modules that is similar to RSVP sending invitations via email. A cross-site scripting vulnerability exists in the Drupal Node Invite module versions prior to...

Drupal Shibboleth Authentication Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Shibboleth Authentication is one of the user login and get access to the authentication module . A cross-site request forgery vulnerability exists in the Drupal Shibboleth...

Drupal Quizzler Module Cross-Site Scripting Vulnerability

The Drupal Quizzler module is a Drupal module for creating online tests. A cross-site scripting vulnerability exists in Drupal Quizzler module versions prior to 7-x.1.16. This allows an authenticated, remote attacker to inject arbitrary web script or HTML via a node header...

Drupal Node Invite Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node Invite is one of the modules that is similar to RSVP sending invitations via email. A cross-site request forgery vulnerability exists in the Drupal Node Invite module versions prio...

Design/Logic Flaw

The Certify module before 6.x-2.3 for Drupal does not properly perform node access checks, which allows remote authenticated users to bypass intended access restrictions and obtain sensitive PDF certificate information via vectors related to "showing and creating the PDF certificates."...

CVE-2015-3404

The Certify module before 6.x-2.3 for Drupal does not properly perform node access checks, which allows remote authenticated users to bypass intended access restrictions and obtain sensitive PDF certificate information via vectors related to "showing and creating the PDF certificates."...