Drupal 4.x URL-Encoded Input HTML Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16117/info Drupal is prone to an HTML injection vulnerability when handling URL-encoded HTML and script code in message content. This issue is due to a failure in the application to properly sanitize user-supplied input...

Drupal 4.1/4.2 Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/8235/info The Drupal content management system is prone to a cross-site scripting vulnerability. This issue is exposed through the main page and through other sub-pages. An attacker may exploit this issue by including...

Drupal 5 / 6 / 7 Cross Site Scripting

Hi, There is a persistent XSS in Drupal versions 5.x, 6.x and 7.x I have not yet tested Drupal 8.x due to not being fully released . The function which is vulnerable is the watchdog function, where the $message parameter does not get sanitized and you can pass through arbitrary code to be execute...

CVE-2014-4506

Cross-site scripting XSS vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the 1 attribute or 2 content value for a...

CVE-2014-4505

Cross-site scripting XSS vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the 1 attribute or 2 content value for a...

CVE-2014-4505

Cross-site scripting XSS vulnerability in the Easy Breadcrumb module 7.x-2.x before 7.x-2.10 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2014-4506

The CVE-2014-4506 issue is a Cross-Site Scripting (XSS) vulnerability in the Drupal Custom Meta module. Affected are Custom Meta 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.3. The root cause is insufficient sanitization of user input for meta tag attributes and content on the administrati...

CVE-2014-4505

The CVE-2014-4505 entry applies to the Drupal contributed module Easy Breadcrumb (7.x-2.x) prior to 7.x-2.10. Root cause: the module does not properly sanitize user-supplied values, enabling cross-site scripting (XSS). Impact: remote attackers could inject arbitrary script/HTML via unspecified ve...

CVE-2014-4506

Cross-site scripting XSS vulnerability in the Custom Meta module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.3 for Drupal allows remote authenticated users with the "administer custom meta settings" permission to inject arbitrary web script or HTML via the 1 attribute or 2 content value for a...

CVE-2014-4303

Multiple cross-site scripting XSS vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the 1 Twitter and 2 Facebook username settings...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the 1 Twitter and 2 Facebook username settings...

CVE-2014-4303

Multiple cross-site scripting XSS vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the 1 Twitter and 2 Facebook username settings...

CVE-2014-4303

CVE-2014-4303 affects the Drupal Touch theme (7.x-1.x) prior to 7.x-1.9. The vulnerability arises because the theme does not sufficiently sanitize input for Twitter and Facebook username settings, enabling cross-site scripting (XSS) by authenticated administrators with the Administer themes permi...

SA-CONTRIB-2014-062 -Passsword Policy - Multiple vulnerabilities

The Password Policy module enables you to define and enforce password policies with various constraints on allowable user passwords. Access bypass and information disclosure 7.x only The module has a history constraint, which when enabled, disallows a user's password from being changed to match a...

SA-CONTRIB-2014-063 - Easy Breadcrumb - Cross Site Scripting (XSS)

The Easy Breadcrumb module generates breadcrumbs from path aliases. This module does not properly sanitize user-supplied values creating a Cross Site Scripting XSS vulnerability. CVE identifiers issued CVE-2014-4505 Versions affected Easy breadcrumbs 7.x-2.x versions prior to 7.x-2.10. Drupal cor...

SA-CONTRIB-2014-065 - Custom Meta - Cross Site Scripting (XSS)

The module allows you to define and manage custom meta tags. The module does not sufficiently sanitize user input before displaying the attribute and content values for meta tags on the administration page. This vulnerability is mitigated by the fact that an attacker must have access to an accoun...

SA-CONTRIB-2014-061 - VideoWhisper Webcam Plugins - Cross Site Scripting (XSS) - Unsupported

Includes multiple modules for video communications including room listing, pay per view access control. The module doesn't sufficiently filter user supplied text from the url reflected cross site scripting. No special permissions are required to exploit this issue. There are no mitigating factors...

SA-CONTRIB-2014-064 -Course - Access bypass

This module enables you to create e-learning courses with any number of requirements for completion. A "Course object" is a relationship entity between a Course and a learning object, such as a Node. The module doesn't sufficiently check access on Course object edit forms. The configuration optio...