Drupal Taxonomy Path Module Cross-Site Scripting Vulnerability

Drupal is written using the PHP language open source content management framework , which consists of a content management system and PHP development framework together . A cross-site scripting vulnerability exists in the Drupal Taxonomy Path module due to the program failing to properly filter...

Drupal Views Module Open Redirect Vulnerability

Drupal is written using the PHP language open source content management framework , which consists of a content management system and PHP development framework together . An open redirect vulnerability exists in the Drupal Views module that allows an attacker to trick users into redirecting to an...

Drupal Views module access bypass vulnerability (CNVD-2015-01153)

Drupal is written using the PHP language open source content management framework , which consists of a content management system and PHP development framework together . An access bypass vulnerability exists in the Drupal Views module, which can be exploited by an attacker to bypass certain...

Drupal Commerce WeDeal module open redirect vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An open redirect vulnerability exists in the Drupal Commerce WeDeal module due to the application failing to properly filter user-supplied input. An attacker can build a...

Drupal Ajax Timeline Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Ajax Timeline module due to the program failing to properly filter user-supplied input. An attacker could use thi...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Facebook Album Fetcher

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Multiple cross-site scripting vulnerabilities exist in Drupal Facebook Album Fetcher due to the program failing to properly filter user-supplied input. An attacker could u...

Drupal Path Breadcrumbs Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in the Drupal Path Breadcrumbs module that could allow an attacker to bypass certain security restrictions and perform unauthorized...

SA-CONTRIB-2015-045 - Node Access Product - Cross Site Scripting (XSS) - Unsupported

The Node Access Product module provides 'Node access' settings for product nodes, whereby users who purchase the product are granted view access to content, which can be predefined either by taxonomy, by node, or by Views. The module doesn't sufficiently sanitize node titles leading to the...

SA-CONTRIB-2015-043 - Commerce Balanced Payments - Multiple vulnerabilities

Commerce Balanced Payments module integrates Drupal Commerce with the Balanced Payments third-party service. The module doesn't sufficiently sanitize user supplied text in the Bank Account Listing Page, thereby exposing a Cross Site Scripting vulnerability. Also, some URLs were not protected...

SA-CONTRIB-2015-040 - Webform prepopulate block - Cross Site Scripting (XSS)

Webform prepopulate block module enables you to set a webform component to display in a separated block. The module doesn't sufficiently sanitize user supplied text when displaying the block, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that a...

SA-CONTRIB-2015-041 - Feature Set - Cross Site Request Forgery (CSRF)

Feature Set module enables you to enable or disable sets of features or modules. The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause an administrator to enable and disable modules by getting the administrator's browser to make a request to a specially-crafte...

SA-CONTRIB-2015-042 - Node basket - Multiple vulnerabilities - Unsupported

Node basket module enables you to pick up nodes in a basket. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a user with permission to...

SA-CONTRIB-2015-044 - Taxonomy Path - Cross Site Scripting (XSS)

Taxonomy Path module enables you to create custom links to taxonomy terms within a display mode. The module doesn't sufficiently sanitize user provided text in the provided "Link to path" field formatter, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by th...

SA-CONTRIB-2015-046 - Taxonomy Tools - Cross Site Scripting (XSS)

Taxonomy Tools module provides alternative ways of managing taxonomy terms. The module doesn't sufficiently escape node and taxonomy term titles when displaying them, allowing a malicious user to inject code. This vulnerability is mitigated by the fact that an attacker must have a role with...

SA-CONTRIB-2015-039 - Views - Multiple vulnerabilities

The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. Open redirect vulnerability The module does not sanitize user provided URLs when processing the page to break the lock on Views bei...

Drupal GD Infinite Scroll Module Cross-Site Request Forgery Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.GD Infinite Scroll is one of the automatic paging modules used to automatically load the next page of content when scrolling a web page. A cross-site request forgery vulnerability exist...

Drupal GD Infinite Scroll Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.GD Infinite Scroll is one of the automatic paging modules used to automatically load the next page of content when scrolling a web page. A cross-site scripting vulnerability exists in t...

CVE-2015-1568

Cross-site request forgery CSRF vulnerability in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote attackers to hijack the authentication of users with the "edit gd infinite scroll settings" permission for requests that delete settings via unspecified vectors...

CVE-2015-1567

Cross-site scripting XSS vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors...