Design/Logic Flaw

The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file...

Default credentials

The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password...

Code injection

The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to 1 new or 2 modified nodes or 3 their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email...

Directory traversal

Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. dot dot in the path of a cropped picture in the uploader panel...

Code injection

The Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock an account via a crafted user status link...

CVE-2014-5268

The Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock an account via a crafted user status link...

CVE-2014-9152

The userresourcecreate function in the Services module 7.x-3.x before 7.x-3.10 for Drupal uses a password of 1 when creating new user accounts, which makes it easier for remote attackers to guess the password via a brute force attack...

CVE-2014-9151

CVE-2014-9151 affects Drupal’s Services module (7.x-3.x) prior to 7.x-3.10. The vulnerability is due to insufficient flood control / rate limiting on authentication attempts, allowing remote attackers to brute-force the administrative password. The issue is addressed by upgrading to Services 7.x-...

CVE-2014-9151

The Services module 7.x-3.x before 7.x-3.10 for Drupal does not properly limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password...

CVE-2014-5268

The Fasttoggle module 7.x-1.3 and 7.x-1.4 for Drupal allows remote attackers to block or unblock an account via a crafted user status link...

CVE-2014-9153

Cross-site scripting XSS vulnerability in the Services module 7.x-3.x before 7.x-3.10 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the callback parameter in a JSONP response...

CVE-2014-9152

CVE-2014-9152 affects the Drupal Services module (7.x-3.x) prior to 7.x-3.10. The _user_resource_create function creates new user accounts with a password of 1, enabling remote attackers to brute-force the password. Impact is partial confidentiality and integrity risk for newly created accounts; ...

CVE-2014-9156

The vulnerability CVE-2014-9156 affects the Drupal FileField module (6.x-3.x) prior to 6.x-3.13. The root cause is a failing permission check to view files when attaching an uploaded file, enabling remote authenticated users with permission to create or edit content to read private files. Affecte...

CVE-2014-9156

The FileField module 6.x-3.x before 6.x-3.13 for Drupal does not properly check permissions to view files, which allows remote authenticated users with permission to create or edit content to read private files by attaching an uploaded file...

CVE-2014-9155

Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. dot dot in the path of a cropped picture in the uploader panel...

CVE-2014-9154

The Notify module 7.x-1.x before 7.x-1.1 for Drupal does not properly restrict access to 1 new or 2 modified nodes or 3 their fields, which allows remote authenticated users to obtain node titles, teasers, and fields by reading a notification email...

CVE-2014-5268

CVE-2014-5268 affects the Drupal contributed module Fasttoggle (7.x-1.3 and 7.x-1.4). The advisory confirms an access-control flaw: remote attackers can block or unblock user accounts via a crafted user status link, due to a rewrite of the access control that mishandles the user status (allow/blo...

CVE-2014-9155

Summary: CVE-2014-9155 is a directory traversal vulnerability in the Drupal Avatar_Uploader module (6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6). An authenticated user can exploit a Linux/Unix path traversal via a .. in the path of a cropped image to read arbitrary server files access...

CVE-2014-9153

CVE-2014-9153 is a XSS vulnerability in the Drupal Services module for Drupal 7.x-3.x, present before 7.x-3.10. The issue arises from an unfiltered JSONP callback parameter, allowing remote authenticated users to inject arbitrary JavaScript in a JSONP response. Affected version range is Services ...

CVE-2014-9154

The CVE-2014-9154 entry concerns the Drupal Notify module (7.x-1.x) prior to version 7.x-1.1. The vulnerability arises because the module does not properly restrict access to new or modified nodes and their fields, enabling remote authenticated users to view node titles, teasers, and fields by re...