PT-2013-6023

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.29 Drupal versions 7.x before 7.24 Description The issue affects the form API in Drupal, potentially allowing remote attackers to trigger application-specific impacts, such as arbitrary code execution, via...

Drupal 7.x < 7.24 Multiple Vulnerabilities

The remote web server is running a version of Drupal that is 7.x prior to 7.24. It is, therefore, potentially affected by multiple vulnerabilities : - An error exists related to the HTML form API and validation callbacks as used by third-party modules that could allow an attacker to bypass the...

drupal -- multiple vulnerabilities

Drupal Security Team reports: Multiple vulnerabilities were fixed in the supported Drupal core versions 6 and 7. Multiple vulnerabilities due to optimistic cross-site request forgery protection Form API validation - Drupal 6 and 7 Multiple vulnerabilities due to weakness in pseudorandom number...

CVE-2013-5937

Cross-site request forgery CSRF vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete database information via vectors involving the Drupal Form API...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete database information via vectors involving the Drupal Form API...

CVE-2013-5937

CVE-2013-5937 affects the Drupal Click2Sell Suite module (6.x-1.x). The CSRF vulnerability allows remote attackers to hijack administrator authentication for requests that delete database information via Drupal Form API vectors. Affected component is the Click2Sell Suite module; root cause is imp...

CVE-2013-5937

Cross-site request forgery CSRF vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete database information via vectors involving the Drupal Form API...

PT-2013-5877

Name of the Vulnerable Software and Affected Versions Click2Sell Suite module versions 6.x-1.x Description A cross-site request forgery issue allows remote attackers to hijack administrator authentication for requests that delete database information. This is achieved through vectors involving th...

CVE-2013-5937: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the Click2Sell Suite module 6.x-1.x for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete database information via vectors involving the Drupal Form API...

Mandriva Linux Security Advisory : drupal (MDVSA-2013:074)

Updated drupal packages fix security vulnerabilities : Drupal core's text filtering system provides several features including removing inappropriate HTML tags and automatically linking content that appears to be a link. A pattern in Drupal's text matching was found to be inefficient with certain...

CVE-2012-2077: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the ShareThis module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of users with administer sharethis permissions via unknown vectors "outside of the Form API."...

CVE-2012-1589

Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL...

CVE-2012-1589

Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL...

Open redirect

Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL...

CVE-2012-1589

Removed by vendor...

CVE-2012-1589

Drupal 7.x Form API contains an open redirect vulnerability (CVE-2012-1589) in which the redirect destination URL is not validated. This can allow remote attackers to redirect users to arbitrary sites, enabling phishing. Affected software: Drupal core 7.x prior to 7.13. Remediation: upgrade Drupa...

CVE-2012-1589

Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL...

PT-2012-3362

Name of the Vulnerable Software and Affected Versions Drupal versions prior to 7.13 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL. This can be exploited through the Form API...

CVE-2012-1589: Improper Input Validation

Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL...

JVN#45898075: Drupal Form API fails to validate the redirect URL

Drupal is a content management system CMS. Drupal's Form API fails to validate the redirect URL, which may lead to unintended information disclosure. Impact A remote attacker may change the redirect URL of a form. As a result, information such as authentication credentials may be disclosed...