CVE-2015-3349

Multiple cross-site request forgery CSRF vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 deploy or 2 delete an .htaccess file via unspecified vectors...

CVE-2015-3366

CVE-2015-3366 describes a CSRF vulnerability in the Drupal Alfresco module prior to 6.x-1.3. Affected component: Alfresco module (Drupal integration). Root cause: CSRF protection gaps allow remote attackers to perform actions on behalf of authenticated users, potentially deleting an Alfresco node...

CVE-2015-3371

The CVE-2015-3371 Open Redirect vulnerability affects the Drupal Node Invite module up to 6.x-2.x, specifically versions prior to 6.x-2.5. The issue arises from the destination parameter, allowing remote attackers to redirect users to arbitrary websites, enabling phishing. Affected component: Nod...

CVE-2015-3370

Cross-site request forgery CSRF vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to hijack the authentication of users with the "nodeinvitecanmanageinvite" permission for requests that re-enable node invitations via unspecified vectors...

CVE-2015-3362

CVE-2015-3362 affects Drupal’s Video module (7.x-2.x) prior to 7.x-2.11. The vulnerability arises from insufficient sanitization of node titles when using the video WYSIWYG plugin, enabling XSS by remote authenticated users. Affected versions are Video 7.x-2.x from 7.x-2.2-beta1 through 7.x-2.10....

CVE-2015-3342

The CVE-2015-3342 vulnerability affects the Ubercart Currency Conversion module for Drupal (versions 6.x prior to 6.x-1.2). The issue is an open redirect: user-supplied input in the destination query parameter is not properly validated, enabling remote attackers to redirect users to arbitrary sit...

CVE-2015-3354

The CVE-2015-3354 entry concerns the Drupal Wishlist module (versions 6.x-2.x before 6.x-2.7 and 7.x-2.x before 7.x-2.7). The vulnerability is a CSRF flaw that allows remote attackers to hijack the authentication of arbitrary users to perform actions deleting wishlist purchase intentions via unsp...

CVE-2015-3373

CVE-2015-3373 affects the Drupal Amazon AWS contributed module prior to version 7.x-1.3. The vulnerability stems from generating an access token using the base URL and AWS access key, enabling remote attackers to guess the token value and trigger creation of backups via a crafted URL. Affected pr...

CVE-2015-3374

CVE-2015-3374 affects the Drupal Corner module. The vulnerability allows remote attackers to hijack administrator sessions by forcing the admin’s browser to perform CSRF requests to enable or disable corners, via unspecified vectors. Affected are Corner module versions prior to a fixed release; D...

CVE-2015-3351

Multiple cross-site request forgery CSRF vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable, 2 disable, or 3 delete a report via unspecified vectors...

CVE-2015-3344

Cross-site scripting XSS vulnerability in the Course module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3348

CVE-2015-3348 concerns the Cloudwords for Multilingual Drupal module (Drupal 7.x) prior to 7.x-2.3. The vulnerability is an XSS flaw where remote authenticated users can inject arbitrary script/HTML via a node title due to insufficient sanitization. Affected software: Cloudwords for Multilingual ...

CVE-2015-3354

Cross-site request forgery CSRF vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete wishlist purchase intentions via unspecified vectors...

CVE-2015-3361

Cross-site scripting XSS vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plugin is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3358

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

CVE-2015-3349

The CVE-2015-3349 entry concerns Drupal’s Htaccess module (7.x-2.x) with CSRF flaws that allow remote attackers to hijack administrator sessions to deploy or delete an .htaccess file. Affected: Htaccess module for Drupal 7.x, prior to 7.x-2.3. Root cause: Cross-site request forgery in the module’...

CVE-2015-3365

CVE-2015-3365 is a Drupal XSS vulnerability in the nodeauthor module. The issue arises from insufficient sanitization of Profile2 fields inside a provided block, allowing remote authenticated users to inject arbitrary web script or HTML. Affected products include the nodeauthor module (all versio...

CVE-2015-3348

Cross-site scripting XSS vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3367

CVE-2015-3367 corresponds to CSRF vulnerabilities in the Drupal Patterns module. Affected: Patterns 7.x-2.x prior to 7.x-2.2. Impact: remote attackers could leverage CSRF to cause administrators to restore, publish, or unpublish patterns. Root cause: missing or weak CSRF protection in the Pattern...

CVE-2015-3375

The CVE-2015-3375 entry concerns the Drupal Shibboleth Authentication module. A CSRF vulnerability allows remote attackers to hijack administrator authentication for requests that delete user role matching rules. Affected: Shibboleth Authentication module for Drupal 6.x-4.x before 6.x-4.1 and 7.x...