14440 matches found
CVE-2014-9015
Removed by vendor...
Drupal 6.x < 6.34 / 7.x < 7.34 Multiple Vulnerabilities
The remote web server is running a version of Drupal that is 6.x prior to 6.34 or 7.x prior to 7.34. It is, therefore, potentially affected by the following vulnerabilities : - There exists an unspecified flaw that is triggered when handling a specially crafted request that may allow a remote...
CVE-2014-9026
The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors...
CVE-2014-9025
The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...
CVE-2014-9024
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path...
CVE-2014-9023
The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission...
Default configuration
The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...
Information disclosure
The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors...
Design/Logic Flaw
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form...
Path traversal
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path...
Authentication flaw
The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission...
CVE-2014-9026
The CVE-2014-9026 issue affects Drupal’s Ubercart module (7.x-3.x) prior to 7.x-3.7, where the per-user order history view is not properly protected. Remote authenticated users with the “view own orders” permission could access sensitive order-history information via unspecified vectors. Affected...
CVE-2014-9026
The Ubercart module 7.x-3.x before 7.x-3.7 for Drupal does not properly protect the per-user order history view, which allows remote authenticated users with the "view own orders" permission to obtain sensitive information via unspecified vectors...
CVE-2014-9024
The Protected Pages module 7.x-2.x before 7.x-2.4 for Drupal allows remote attackers to bypass the password protection via a crafted path...
CVE-2014-9023
The Twilio module 7.x-1.x before 7.x-1.9 for Drupal does not properly restrict access to the Twilio administration pages, which allows remote authenticated users to read and modify authentication tokens by leveraging the "access administration pages" Drupal permission...
CVE-2014-9022
The Webform Component Roles module 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8 for Drupal allows remote attackers to bypass the "disabled" restriction and modify read-only components via a crafted form...
CVE-2014-9023
Summary (CVE-2014-9023): The Drupal Twilio module (7.x-1.x, affected versions prior to 7.x-1.9) exposes authentication tokens because access to the Twilio administration pages is not properly restricted. Remote authenticated users with the Drupal permission “access administration pages” can read ...
CVE-2014-9022
The CVE-2014-9022 issue affects Drupal’s Webform Component Roles module: versions 6.x-1.x before 6.x-1.8 and 7.x-1.x before 7.x-1.8. The root cause is that the module allows remote attackers to bypass the disabled restriction and modify read-only webform components via a crafted form. Impact is r...
CVE-2014-9024
CVE-2014-9024 affects the Drupal contributed module Protected Pages (7.x-2.x) prior to version 7.x-2.4. The vulnerability arises because the module did not sufficiently protect variations on a protected path, allowing remote attackers to bypass password protection via a crafted path. The advisory...
CVE-2014-9025
The default checkout completion rule in the commerceorder module in the Drupal Commerce module 7.x-1.x before 7.x-1.10 for Drupal uses the email address as the username for new accounts created at checkout, which allows remote attackers to obtain sensitive information via unspecified vectors...