SA-CONTRIB-2015-077 - OG tabs - Cross Site Scripting (XSS)

OG Tabs modules provides a secondary menu with links to nodes of the same OG group. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission t...

SA-CONTRIB-2014-125 - Organic Groups Menu - Access bypass

This module enables you to associate menus with Organic Groups OG. It allows you to create one or more menus per group, configure and apply menu permissions in a group context, add/edit menu links directly from the entity form, etc. The module doesn't sufficiently check the menu parameters passed...

CVE-2014-8734

The CVE-2014-8734 vulnerability affects the Drupal OG Menu (OG Menu) module for Drupal 7.x, specifically versions prior to 7.x-2.2. Remote authenticated users with the treated permission “access administration pages” can alter module settings via unspecified vectors. The issue is tied to the OG M...

CVE-2014-8734

The Organic Groups Menu aka OG Menu module before 7.x-2.2 for Drupal allows remote authenticated users with the "access administration pages" permission to change module settings via unspecified vectors...

SA-CONTRIB-2014-105 - OG Menu - Access Bypass

OG Menu allows using menus within Organic Groups. The permissions for accessing the module settings were to broad, possibly granting access to users who would normally not be able to change the OG Menu configuration. This vulnerability is mitigated by the fact that an attacker must have a role wi...

CVE-2013-4498

The Spaces OG submodule in the Spaces module 6.x-3.x before 6.x-3.7 for Drupal does not properly delete organic group group spaces content when using the option to move to a new group, which causes the content to be "orphaned" and allows remote authenticated users with the "access content"...

CVE-2013-7065

The Organic Groups OG module 7.x-2.x before 7.x-2.3 for Drupal allows remote attackers to bypass access restrictions and post to arbitrary groups via a group audience field, as demonstrated by the oggroupref field...

CVE-2013-7065

The CVE concerns the Drupal Organic Groups (OG) module for Drupal 7.x-2.x, specifically versions prior to 7.x-2.3. The vulnerability allows remote attackers to bypass access restrictions and post to arbitrary groups using the og_group_ref field, enabling group-wide content posting beyond intended...

Cross site request forgery (csrf)

The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which allows remote attackers to bypass intended access restrictions via a request...

CVE-2013-7067

The OG Features module 6.x-1.x before 6.x-1.4 for Drupal does not properly override pages that have an access callback set to false, which allows remote attackers to bypass intended access restrictions via a request...

CVE-2013-7067

Summary of CVE-2013-7067 (Drupal OG Features module): The vulnerability affects the Drupal OG Features module (version 6.x-1.x prior to 6.x-1.4). The module does not properly override pages when an access callback is explicitly set to FALSE, allowing remote attackers to bypass intended access res...

SA-CONTRIB-2013-097 - OG Features - Access bypass

This module enables you to enable and disable bundles of functionality for individual Organic groups. In order to provide this functionality, this module must override all menu callbacks available in the system, in order to delegate access based on the current Organic group you are contextually i...

SA-CONTRIB-2013-095 - Organic Groups - Access bypass

Two issues exist within entity references and permissions relating to OG, allowing users potential access bypass. Posting content into groups where a user is not a member Organic Groups does not sufficiently check the group audience fields e.g. oggroupref field from being populated with invalid...

CVE-2013-0317

Cross-site scripting XSS vulnerability in the Manager Change for Organic Groups ogmanagerchange module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field...

CVE-2012-5539

The Drupal OG (Organic Groups) module for 7.x-1.x is vulnerable prior to 7.x-1.5. The flaw occurs in the handling of pending group memberships, allowing remote authenticated users to post to groups they are not properly authorized for by editing their own account while a pending membership is awa...

SA-CONTRIB-2012-148 - OG - Access Bypass

OG Organic groups enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. A group membership can be given immediately upon subscribing, or be pending - waiting for a group administrat...

Fedora Update for drupal6-og FEDORA-2012-11479

Check for the Version of drupal6-og OpenVAS Vulnerability Test Fedora Update for drupal6-og FEDORA-2012-11479 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for drupal6-og FEDORA-2012-7259

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Fedora Update for drupal6-og FEDORA-2012-7259

Check for the Version of drupal6-og OpenVAS Vulnerability Test Fedora Update for drupal6-og FEDORA-2012-7259 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...

Fedora Update for drupal6-og FEDORA-2012-11476

Check for the Version of drupal6-og OpenVAS Vulnerability Test Fedora Update for drupal6-og FEDORA-2012-11476 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under...