Cross site scripting

Cross-site scripting XSS vulnerability in the Poll Chart Block module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a poll node title...

Cross site scripting

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

CVE-2014-9505

CVE-2014-9505 is a Cross-Site Scripting (XSS) vulnerability in the Drupal School Administration module (7.x-1.x) before 7.x-1.8. The issue arises because node titles are not properly sanitized, allowing remote authenticated users with permission to create or edit a class node to inject arbitrary ...

CVE-2014-9499

Cross-site scripting XSS vulnerability in the Godwin's Law module before 7.x-1.1 for Drupal, when using the dblog module, allows remote authenticated users to inject arbitrary web script or HTML via a Watchdog message...

CVE-2014-9500

CVE-2014-9500 affects the Moip module for Drupal 7.x (versions prior to 7.x-1.4). The vulnerability is a cross-site scripting (XSS) flaw caused by insufficient filtering of data in automatic notifications, allowing remote attackers to inject arbitrary script or HTML via the notification page call...

CVE-2014-9501

Cross-site scripting XSS vulnerability in the Poll Chart Block module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a poll node title...

CVE-2014-9498

Cross-site scripting XSS vulnerability in the Webform Invitation module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4 for Drupal allows remote authenticated users with the Webform: Create new content, Webform: Edit own content, or Webform: Edit any content permission to inject arbitrary web...

CVE-2014-9501

The CVE concerns the Drupal Poll Chart Block module (Drupal 7.x, versions prior to 7.x-1.2). The issue is an XSS vulnerability caused by insufficient sanitization of poll node titles displayed in the poll chart block, allowing remote authenticated users to inject arbitrary script/HTML. Affected p...

CVE-2014-9500

Cross-site scripting XSS vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback...

CVE-2014-9498

The Drupal Webform Invitation module (7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.4) is affected by an XSS vulnerability due to insufficient sanitization of node titles. Exploitation requires an attacker to have one of the Webform-related permissions: Webform: Create new content, Webform: Edi...

CVE-2014-9499

The CVE-2014-9499 entry applies to the Drupal contributed module Godwin’s Law (Drupal 7.x, vulnerable up to 7.x-1.0). The underlying issue is an XSS in the Watchdog/dblog integration, allowing remote authenticated users to inject arbitrary web script or HTML via a Watchdog message. The exploitabl...

CVE-2014-9505

Cross-site scripting XSS vulnerability in the School Administration module 7.x-1.x before 7.x-1.8 for Drupal allows remote authenticated users with permission to create or edit a class node to inject arbitrary web script or HTML via a node title...

Drupal Context Module Open Redirect Vulnerability

Drupal is written using the PHP language open source content management framework , which consists of a content management system and PHP development framework together . An open redirection vulnerability exists in the Drupal Context Module, which allows remote attackers to construct malicious UR...

Drupal Htaccess Module Cross-Site Request Forgery Vulnerability

Drupal is written using the PHP language open source content management framework , which consists of a content management system and PHP development framework together . A cross-site request vulnerability exists in the Drupal Htaccess Module, which allows remote attackers to construct malicious...

SA-CONTRIB-2015-003 - PHPlist Integration Module - SQL Injection

The PHPlist Integration module provides an integration between a Drupal website and phpList newsletter manager. The module provides two main features: user sync and sending a node as a newsletter. The module introduces a SQL Injection vulnerability to the phpList database. The Drupal database is...

SA-CONTRIB-2015-009 - Linkit - Cross Site Scripting (XSS)

Linkit provides an easy interface for internal and external linking with wysiwyg editors and fields by using an autocomplete field. The module doesn't sufficiently sanitize node titles in the result list if the node search plugin is enabled. This vulnerability is mitigated by the fact that an...

SA-CONTRIB-2015-008 - Batch Jobs - Cross Site Request Forgery (CSRF)

The Batch Jobs project is a scalable way to execute a list of tasks. Links that take actions on batch jobs are not protected from Cross Site Request Forgery CSRF. A malicious individual could cause a user that has permission to access a particular batch job or an administrator to delete the recor...

SA-CONTRIB-2015-001 - OPAC - Cross Site Request Forgery (CSRF)

OPAC module enables you to create mappings between node fields and ILS record fields. The module doesn't ask for confirmation when removing a mapping, leaving this operation vulnerable to cross-site request forgery CSRF attacks. CVE identifiers issued CVE-2015-3343 Versions affected OPAC 7.x-2.x...

SA-CONTRIB-2015-013 - Field Display Label - Cross Site Scripting (XSS)

This module enables you to use a different label for displaying fields from the label used when viewing the field in a form. The module doesn't sufficiently sanitize the alternate field label in content types settings. This vulnerability is mitigated by the fact that an attacker must have a role...

SA-CONTRIB-2015-002 - Course - Cross Site Scripting (XSS)

Course module enables you to create e-learning courses with any number of requirements for completion. The module doesn't sufficiently filter node title displays when being used in a course. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to creat...