PT-2018-19491

This module enables you to create fields for storing decimal values as two integers numerator and denominator for maximum precision. The module doesn't sufficiently filter XSS strings out of field labels. This vulnerability is mitigated by the fact that an attacker must have a role with the abili...

CVE-2014-9739

Cross-site scripting XSS vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields...

CVE-2014-9739

Cross-site scripting XSS vulnerability in the Node Field module 7.x-2.x before 7.x-2.45 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields...

CVE-2014-9739

CVE-2014-9739 affects the Drupal Node Field module (7.x-2.x) prior to 7.x-2.45. The vulnerability is a cross-site scripting (XSS) flaw that allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors involving internal fields. Root cau...

CVE-2012-5588

The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors...

CVE-2012-5587

Cross-site scripting XSS vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the mailto link...

CVE-2012-5588

The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors...

CVE-2012-5587

CVE-2012-5587 is a Cross-site Scripting (XSS) vulnerability in the Drupal Email Field contributed module (6.x-1.x) prior to 6.x-1.3. The issue allows remote attackers to inject arbitrary web script or HTML via the mailto link output, affecting Drupal 6.x sites using that module. Core Drupal is no...

CVE-2012-5588

The CVE-2012-5588 entry concerns the Drupal Email Field module (6.x-1.x) before 6.x-1.3. When used with a field-permission module and the contact field formatter set to full or teaser, it fails to properly check permissions, potentially allowing remote attackers to email the stored address throug...

PT-2012-6037

Name of the Vulnerable Software and Affected Versions Drupal Email Field module versions 6.x-1.x before 6.x-1.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the mailto link in the Email Field module. Recommendations For...

CVE-2012-5587: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Email Field module 6.x-1.x before 6.x-1.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the mailto link...

CVE-2012-5588: Undefined Security Weakness

The Email Field module 6.x-1.x before 6.x-1.3 for Drupal, when using a field permission module and the field contact field formatter is set to the full or teaser display mode, does not properly check permissions, which allows remote attackers to email the stored address via unspecified vectors...

CVE-2012-4499

The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors...

Code injection

The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors...

CVE-2012-4499

The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors...

CVE-2012-4499

The CVE-2012-4499 issue affects the Drupal Email Field module (versions 6.x-1.x prior to 6.x-1.2 and 7.x-1.x prior to 7.x-1.1). The vulnerability arises on the contact formatter page, allowing remote attackers to email the stored address in the entity via unspecified vectors. The impact is exposu...

CVE-2012-4499: Undefined Security Weakness

The contact formatter page in the Email Field module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to email the stored address in the entity via unspecified vectors...

CVE-2010-1998

Cross-site scripting XSS vulnerability in the CCK TableField module 6.x before 6.x-1.2 for Drupal allows remote authenticated users, with certain node creation or editing privileges, to inject arbitrary web script or HTML via table headers...