CVE-2013-4595

The Secure Pages module 6.x-2.x before 6.x-2.0 for Drupal does not properly match URLs, which causes HTTP to be used instead of HTTPS and makes it easier for remote attackers to obtain sensitive information via a crafted web page...

CVE-2013-4597

The Revisioning module 7.x-1.x before 7.x-1.6 for Drupal does not properly check node access permissions for content marked unpublished by the Scheduled module, which allows remote authenticated users to obtain sensitive information via unspecified vectors...

CVE-2013-4597

The Drupal Revisioning module (7.x-1.x) is affected by CVE-2013-4597: versions prior to 7.x-1.6 do not properly enforce node access when content is unpublished by the Scheduler module, allowing remote authenticated users to reveal sensitive information via unspecified vectors. The vulnerability s...

CVE-2013-4599

The CVE-2013-4599 affects the Misery module for Drupal 6.x-2.x (pre-6.x-2.5) and 7.x-2.x (pre-7.x-2.2). The root cause is a misconfiguration of the delay misery setting, which when high can cause remote attackers to trigger denial of service by exhausting web-server processes through multiple req...

CVE-2013-4596

The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass access restrictions via a node listing...

Authentication flaw

The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass access restrictions via a node listing...

CVE-2013-4596

The Node Access Keys module 7.x-1.x before 7.x-1.1 for Drupal does not properly check permissions, which allows remote attackers to bypass access restrictions via a node listing...

CVE-2013-4596

The CVE-2013-4596 entry concerns Drupal’s Node Access Keys module (7.x-1.x) prior to 7.x-1.1. The vulnerability arises from insufficient permission checks, allowing remote attackers to bypass access restrictions via a node listing. Affected version: Node Access Keys 7.x-1.0 (Drupal 7). The issue ...

CVE-2014-3933

Cross-site scripting XSS vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field...

Cross site scripting

Cross-site scripting XSS vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field...

CVE-2014-3933

The CVE-2014-3933 entry concerns Drupal's AddressField Tokens module (7.x-1.x) with a vulnerability in the address components field formatter that allows XSS by remote authenticated users. Affected versions are 7.x-1.x prior to 7.x-1.4. The root cause is improper filtering of address field values...

CVE-2014-3933

Cross-site scripting XSS vulnerability in the address components field formatter in the AddressField Tokens module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via an address field...

CVE-2013-4177

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors...

CVE-2013-4178

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password OTP...

Default credentials

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password OTP...

Authentication flaw

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors...

CVE-2013-4177

The CVE-2013-4177 entry refers to the Drupal Google Authenticator login module (versions 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4). The underlying issue is that the module does not properly identify user account names, which could allow remote attackers to bypass the two‑factor authentic...

CVE-2013-4177

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal does not properly identify user account names, which might allow remote attackers to bypass the two-factor authentication requirement via unspecified vectors...

CVE-2013-4178

CVE-2013-4178 affects the Google Authenticator login module for Drupal (6.x-1.x prior to 6.x-1.2; 7.x-1.x prior to 7.x-1.4). The issue allows remote attackers to gain access by replaying a login request containing username, password, and OTP. Affected versions are explicit; Drupal core is not aff...

CVE-2013-4178

The Google Authenticator login module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to obtain access by replaying the username, password, and one-time password OTP...