CVE-2014-7979

Cross-site scripting XSS vulnerability in the SimpleCorp theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

CVE-2014-7980

Multiple cross-site scripting XSS vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via the skiplinktext setting and unspecified...

CVE-2014-7980

Zen theme for Drupal 7.x is affected by CVE-2014-7980, with multiple XSS vulnerabilities in template.php. The issues allow remote authenticated users with the administer themes permission to inject arbitrary script/HTML via skip_link_text and other theme settings. Affected versions: Zen 7.x-5.x b...

CVE-2014-7978

The CVE-2014-7978 entry concerns the Bluemasters (BlueMasters) Drupal 7.x-2.x theme. The vulnerability is a stored/reflected XSS caused by insufficient sanitization of theme settings, allowing remote authenticated users with the administer themes permission to inject arbitrary script/HTML via the...

CVE-2014-7978

Cross-site scripting XSS vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via vectors related to theme settings...

CVE-2014-7979

CVE-2014-7979 is an XSS vulnerability in the SimpleCorp Drupal theme (7.x-1.x) affecting 7.x-1.0 prior to 7.x-1.1. The issue allows remote authenticated users with the administer themes permission to inject arbitrary script/HTML via theme settings. Exploitation details are not provided in the ini...

SA-CONTRIB-2014-097 - nodeaccess - Access Bypass

Nodeaccess is a Drupal access control module which provides view, edit and delete access to nodes. This module enables you to inadvertently allow an author of a node view/edit/delete the node in question who may not have access. The module over-eagerly grants read/write/delete access to all autho...

SA-CONTRIB-2014-102 - Document - Cross Site Scripting

Document module is a basic Document Management System for Drupal. Cross Site Scripting XSS The module wasn't sanitizing user input sufficiently in a few use cases. This vulnerability is mitigated by the the fact that a user must have permissions to add or edit documents to be able to exploit the...

SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS)

OAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication. Within its API code the Client class exposes variables in an error message, which originate from a third party source without proper sanitisation thus leading to a Cross Site Scripti...

CVE-2014-7870

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to...

CVE-2014-7869

Cross-site scripting XSS vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer contexts" permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer contexts" permission to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to...

CVE-2014-7869

Cross-site scripting XSS vulnerability in the configuration UI in the Context Form Alteration module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the "administer contexts" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-7870

Cross-site scripting XSS vulnerability in the Custom Search module 6.x-1.x before 6.x-1.12 and 7.x-1.x before 7.x-1.14 for Drupal allows remote authenticated users with the "administer custom search" permission to inject arbitrary web script or HTML via the "Label text" field to...

CVE-2014-7870

CVE-2014-7870 is a Drupal XSS vulnerability in the Custom Search module. Affected: Custom Search 6.x-1.x < 6.x-1.12 and 7.x-1.x

CVE-2014-7869

The vulnerability CVE-2014-7869 affects the Drupal contributed module Context Form Alteration (7.x-1.x) prior to 7.x-1.2. The root cause is insufficient input sanitization in the module’s Configuration UI, allowing remote authenticated users with the administer contexts permission to inject arbit...

CVE-2014-5267

modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document...

UBUNTU-CVE-2014-5267

modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document...

Design/Logic Flaw

modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document...