CVE-2015-3345

The CVE-2015-3345 issue affects the Drupal PHPlist Integration Module (6.x-1.x) before 6.x-1.7. The vulnerability is an SQL injection that could allow remote administrators to execute arbitrary SQL commands via the phpList database. Root cause: the module’s integration points expose the Drupal/da...

CVE-2015-3346

The CVE-2015-3346 entry documents an SQL injection vulnerability in the Drupal WikiWiki module for 6.x-1.x before 6.x-1.2, enabling remote attackers to execute arbitrary SQL commands via unspecified vectors. The issue affects the WikiWiki module (Drupal contrib) and is tied to improper input sani...

CVE-2015-3347

Cross-site request forgery CSRF vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims via an unknown menu callback...

CVE-2015-3358

The CVE concerns the Drupal Tadaa! module (pre-7.x-1.4) which contains multiple open redirect vulnerabilities in its destination parameter used by callbacks that enable/disable modules or change variables. Attackers could lure users to arbitrary sites and conduct phishing via crafted URLs, as des...

CVE-2015-3350

The CVE-2015-3350 issue affects the Drupal Todo Filter module, not Drupal core. Affected: Todo Filter 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.1. Root cause: cross-site request forgery (CSRF) that lets remote attackers hijack a user’s authenticated session to toggle a task via unspecified ...

CVE-2015-3370

CVE-2015-3370 — Drupal Node Invite CSRF : A CSRF in the Drupal Node Invite module (6.x prior to 6.x-2.5) allows remote attackers to hijack the authentication of users who have the "node_invite_can_manage_invite" permission for requests that re-enable node invitations via unspecified vectors. Affe...

CVE-2015-3365

Cross-site scripting XSS vulnerability in the nodeauthor module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a Profile2 field in a provided block...

CVE-2015-3353

Cross-site scripting XSS vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings...

CVE-2015-3346

SQL injection vulnerability in the WikiWiki module before 6.x-1.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-3374

Multiple cross-site request forgery CSRF vulnerabilities in the Corner module for Drupal allow remote attackers to hijack the authentication of administrators for requests that 1 enable or 2 disable corners via unspecified vectors...

CVE-2015-3375

Cross-site request forgery CSRF vulnerability in the Shibboleth Authentication module before 6.x-4.1 and 7.x-4.x before 7.x-4.1 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete user role matching rules via unspecified vectors...

CVE-2015-3355

Multiple cross-site request forgery CSRF vulnerabilities in the Batch Jobs module before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of certain users for requests that 1 delete a batch job record or 2 execute a task via unspecified vectors...

CVE-2015-3373

The Amazon AWS module before 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote attackers to guess the token value and create backups via a crafted URL...

CVE-2015-3369

Cross-site scripting XSS vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a term name in a block...

CVE-2015-3344

The CVE-2015-3344 issue affects the Drupal Course module (versions 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.4). The underlying problem is insufficient filtering of node title displays, enabling remote authenticated users to inject arbitrary script/HTML via a node title (XSS). Affected ...

CVE-2015-3359

Summary: CVE-2015-3359 concerns multiple XSS vulnerabilities in the Drupal Room Reservations module (7.x-1.x) prior to 7.x-1.1. Affected component: Room Reservations module for Drupal 7.x. Root cause: module fails to sufficiently sanitize input in the node title of Room Reservations Category and ...

CVE-2015-3372

Cross-site scripting XSS vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3356

CVE-2015-3356 affects the Drupal Tadaa! module (7.x, prior to 7.x-1.4). The vulnerability arises from multiple unprotected CSRF vectors that allow a logged-in attacker with the module permission to perform actions such as enabling/disabling modules or changing configuration by coaxing a user to m...

CVE-2015-3368

CVE-2015-3368 affects Drupal Classified Ads module (versions prior to 6.x-3.1 and 7.x-3.x prior to 7.x-3.1). The vulnerability is a cross-site scripting (XSS) in the administration UI where remote authenticated users with the administer taxonomy permission can inject arbitrary script/HTML via the...

CVE-2015-3352

The Jammer module for Drupal is affected by CVE-2015-3352. A CSRF weakness in Jammer 6.x-1.x (before 6.x-1.8) and 7.x-1.x (before 7.x-1.4) lets an attacker cause an administrator to perform actions that delete settings for (1) hidden form elements or (2) status messages via the report administrat...