SA-CONTRIB-2015-026 - Taxonews - Cross Site Scripting (XSS)

This module enables you to create blocks of nodes carrying a given taxonomy term. The module doesn't sufficiently escape term names in the blocks it builds leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

SA-CONTRIB-2015-028 - Shibboleth Authentication - Cross Site Request Forgery (CSRF)

Shibboleth Authentication module allows users to log in and get permissions based on federated SAML2 authentication. The roles that are assigned to users are based on a matching list. A malicious attacker can delete matching rules from the list by getting the administrator's browser to make a...

SA-CONTRIB-2015-025 - Patterns - Cross Site Request Forgery (CSRF)

Patterns module manages and automates site configuration. Site configurations stored in XML or YAML are called Patterns, and these are easy to read, modify, manage & share and can be executed manually or as a part of an automated web site deployment. Some links were not protected against CSRF. A...

Drupal Wishlist Module Cross-Site Request Forgery Vulnerability

Drupal is a free and open source content management system developed in PHP. Cross-site request forgery vulnerabilities exist in the Drupal Wishlist module, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Video Module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site scripting vulnerabilities exist in the Drupal Video module because it fails to properly filter user-supplied input. An attacker could potentially exploit these vulnerabilities to execute arbitrary...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Room Reservations Module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site scripting vulnerabilities exist in the Drupal Room Reservations module because it fails to properly filter user-supplied input. An attacker could use these vulnerabilities to execute arbitrary script...

Drupal Wishlist Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Wishlist module, which could be exploited by an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of an affected sit...

Drupal Content Analysis Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Content Analysis module because it fails to properly filter user-supplied input. An attacker may be able to exploit this vulnerability to execute arbitrary script...

Multiple cross-site scripting vulnerabilities in Drupal nodeauthor module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site scripting vulnerabilities exist in the Drupal nodeauthor module because it fails to properly filter user-supplied input. An attacker could use these vulnerabilities to execute arbitrary script code in...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Contact Form Fields

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in Drupal Contact Form Fields, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Tadaa! module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in the Drupal Tadaa! module, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

CVE-2015-1051

Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

Open redirect

Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

CVE-2015-1051

Open redirect vulnerability in the Context UI module in the Context module 7.x-3.x before 7.x-3.6 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

CVE-2015-1051

Summary: CVE-2015-1051 is an Open Redirect vulnerability in the Drupal Context module’s Context UI (Context module, 7.x-3.x) allowing redirection to arbitrary sites via the destination parameter. The affected line is before 7.x-3.6 for Drupal. What’s affected: Drupal’s Context module Context UI c...

Fedora 21 : drupal6-flag-2.1-3.fc21 (2015-0078)

CVE-2014-3453 - https://access.redhat.com/security/cve/CVE-2014-3453 - http://www.openwall.com/lists/oss-security/2014/05/12/ 2 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean...

[SECURITY] Fedora 21 Update: drupal6-flag-2.1-3.fc21

Flag is a flexible flagging system that is completely customizable by the administrator. Using this module, the site administrator can provide any number of flags for nodes, comments, users, and any other type of entity. Some possibilities include bookmarks, marking important, friends, or flag as...

[SECURITY] Fedora 20 Update: drupal6-flag-2.1-3.fc20

Flag is a flexible flagging system that is completely customizable by the administrator. Using this module, the site administrator can provide any number of flags for nodes, comments, users, and any other type of entity. Some possibilities include bookmarks, marking important, friends, or flag as...

SA-CONTRIB-2015-022 - nodeauthor - Cross Site Scripting (XSS) - Unsupported

This module displays node author information in a jQuery slider. The module doesn't sufficiently sanitize Profile2 fields in a provided block. This vulnerability is mitigated by the fact that an attacker must have a user account allowed to edit profile fields. CVE identifiers issued CVE-2015-3365...

SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS)

This module enables you to upload, convert and playback videos. The module doesn't sufficiently sanitize node titles when using the video WYSIWYG plugin, thereby opening a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with th...