CVE-2015-3352

Multiple cross-site request forgery CSRF vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for 1 hidden form elements or 2 status messages via unspecifi...

CVE-2015-3355

The CVE-2015-3355 entry concerns CSRF in the Drupal Batch Jobs module (7.x, pre-1.2). Exploitation could allow remote attackers to hijack a user’s session to perform actions such as deleting a batch job or executing a task via crafted requests, as documented by multiple sources including DRUPAL-S...

CVE-2015-3363

CVE-2015-3363 is a CSRF vulnerability in the Drupal Contact Form Fields module prior to 6.x-2.3. It allows an attacker to trick an authenticated administrator into performing actions (notably deleting fields) on behalf of the admin, via unspecified vectors. Affected versions are all before 6.x-2....

CVE-2015-3343

Cross-site request forgery CSRF vulnerability in the OPAC module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims for requests that remove a mapping via unknown vectors...

CVE-2015-3351

CVE-2015-3351 affects the Drupal Log Watcher module (6.x-1.x) before 6.x-1.2. The issue is a CSRF vulnerability in the report administration links that can allow an attacker to trigger actions (enable, disable, or delete a report) on behalf of an authenticated administrator, effectively hijacking...

CVE-2015-3360

Cross-site scripting XSS vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-3371

Open redirect vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter...

CVE-2015-3362

Cross-site scripting XSS vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title...

CVE-2015-3372

The Drupal Node Invite module (6.x) is vulnerable prior to 6.x-2.5: an XSS flaw allows remote authenticated users to inject script/HTML via a node title. Additional issues include CSRF exposure and an open redirect vulnerability. Affected versions: Node Invite 6.x-2.x before 6.x-2.5; Drupal core ...

CVE-2015-3369

The CVE-2015-3369 vulnerability affects the Drupal Taxonews module (versions < 6.x-1.2 and

CVE-2015-3343

The Drupal OPAC module (7.x-2.x) is vulnerable to a Cross-Site Request Forgery (CSRF) that allows remote attackers to hijack user authentication and remove mappings, because the module does not require confirmation when removing a mapping. Affected versions are OPAC 7.x-2.x prior to 7.x-2.3. The ...

CVE-2015-3357

The CVE targets Drupal’s Wishlist module (versions 6.x-2.7 and 7.x-2.x before 7.x-2.7). Root cause: user-supplied content in log messages is not properly sanitized, allowing remote authenticated users with the "access wishlists" permission to inject arbitrary web script or HTML via unspecified ve...

CVE-2015-3366

Cross-site request forgery CSRF vulnerability in the Alfresco module before 6.x-1.3 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete an alfresco node via unspecified vectors...

KLA10563 Multiple vulnerabilities in Drupal modules

Multiple serious vulnerabilities have been found in Drupal modules. Malicious users can exploit these vulnerabilities to bypass security restrictions, inject arbitrary code or obtain sensitive information. Below is a complete list of vulnerabilities 1. Open redirect vulnerabilities in Commerce...

Display Suite - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-095

Display Suite allows you to take full control over how your content is displayed using a drag and drop interface. In certain situations, Display Suite does not properly sanitize some of the output, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting XSS...

Services - Critical - Multiple Vulnerabilites - SA-CONTRIB-2015-096

Services module enables you to expose an API to third party systems. Access bypass file upload and execution The resource/endpoint for uploading files does not properly sanitize the filename of uploaded files. This vulnerability is mitigated by the fact that the "File Create" resource must be...

[SECURITY] Fedora 20 Update: drupal7-webform-4.7-1.fc20

Webform is the module for making surveys in Drupal. After a submission, users may be sent an e-mail "receipt" as well as sending a notification to administrators. Results can be exported into Excel or other spreadsheet applications. Webform also provides some basic statistical review and has and...

[SECURITY] Fedora 21 Update: drupal7-webform-4.7-1.fc21

Webform is the module for making surveys in Drupal. After a submission, users may be sent an e-mail "receipt" as well as sending a notification to administrators. Results can be exported into Excel or other spreadsheet applications. Webform also provides some basic statistical review and has and...

CiviCRM private report - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-094

CiviCRM private report module enables users to create their own private copies of CiviCRM reports, which they can modify and save to meet their needs without requiring the "Administer reports" permission. The module doesn't sufficiently protect some links against CSRF. A malicious user can cause...

[SECURITY] Fedora 21 Update: drupal7-ctools-1.7-1.fc21

This suite is primarily a set of APIs and tools to improve the developer experience. It also contains a module called the Page Manager whose job is to manage pages. In particular it manages panel pages, but as it grows it will be able to manage far more than just Panels. For the moment, it includ...