SA-CONTRIB-2015-020 - Contact Form Fields - Cross Site Request Forgery (CSRF)

The Contact Form Fields module enables you to create additional fields to site-wide contact form. Some links were not properly protected from CSRF. A malicious user could cause an administrator to delete fields by getting the administrator's browser to make a request to a specially-crafted URL...

SA-CONTRIB-2015-019 - Ubercart Currency Conversion - Open Redirect

This module enables users to change the currency of Ubercart products. When switching the currency, the user is redirected to a page specified in the destination query parameter. The module was not checking that the passed argument was an internal URL, thereby leading to an open redirect...

SA-CONTRIB-2015-017 - Room Reservations - Cross Site Scripting (XSS)

Room Reservations module enables you to manage a room reservation system. The module doesn't sufficiently sanitize the node title of "Room Reservations Category" nodes and the body of "Room Reservations Room" nodes, thereby leading to a Cross Site Scripting XSS vulnerability. This vulnerability i...

SA-CONTRIB-2015-014 - Wishlist - Multiple vulnerabilities

The Wishlist module enables authorized users to create wishlist nodes which describe items they would like for a special occasion. Also, it allows users to indicate their intention to purchase items for other users. The module fails to sanitize user input in log messages, leading to a Cross Site...

SA-CONTRIB-2015-015 - Term Merge - Cross Site Scripting (XSS)

This module enables you to merge synonymous taxonomy terms among themselves. The module doesn't sufficiently filter user input under certain conditions, thereby opening a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to create...

SA-CONTRIB-2015-016 - Tadaa! - Multiple vulnerabilities

Tadaa! is a module aimed at simplifying the process of enabling/disabling modules and altering configuration when switching between different environments, e.g. Production/Staging/Development. The module exposes multiple paths that were not protected against Cross Site Request Forgeries CSRF. A...

SA-CONTRIB-2015-021 - Content Analysis - Cross Site Scripting (XSS)

The Content Analysis module is an API designed to help modules that need to analyze content. The module fails to sanitize user input in log messages, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that only sites with dblog module enabled are...

Multiple Cross-Site Scripting Vulnerabilities in Drupal Linkit Module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site scripting vulnerabilities exist in the Drupal Linkit module because it fails to properly filter user-supplied input. An attacker could use these vulnerabilities to execute arbitrary script code in a...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Log Watcher Module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in the Drupal Log Watcher module, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Jammer Module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in the Drupal Jammer module, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

Drupal Field Display Label Module Cross-Site Scripting Vulnerability

Drupal is a free and open source content management system developed in PHP. A cross-site scripting vulnerability exists in the Drupal Field Display Label module because it fails to properly filter user-supplied input. An attacker may be able to exploit this vulnerability to execute arbitrary...

Multiple Cross-Site Request Forgery Vulnerabilities in Drupal Batch Jobs Module

Drupal is a free and open source content management system developed in PHP. Multiple cross-site request forgery vulnerabilities exist in the Drupal Batch Jobs module, which can be exploited by an attacker to perform certain unauthorized actions and gain access to affected applications...

CVE-2014-9505

Cross-site scripting XSS vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Drupal allows remote authenticated users with permission to create or edit a class node to inject arbitrary web script or HTML via a node title...

CVE-2014-9501

Cross-site scripting XSS vulnerability in the Poll Chart Block module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a poll node title...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

CVE-2014-9499

Cross-site scripting XSS vulnerability in the Godwin's Law module before 7.x-1.1 for Drupal, when using the dblog module, allows remote authenticated users to inject arbitrary web script or HTML via a Watchdog message...

CVE-2014-9498

Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in the Godwin's Law module before 7.x-1.1 for Drupal, when using the dblog module, allows remote authenticated users to inject arbitrary web script or HTML via a Watchdog message...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...

Cross site scripting

Cross-site scripting XSS vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Drupal allows remote authenticated users with permission to create or edit a class node to inject arbitrary web script or HTML via a node title...