Webform CiviCRM Integration - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-160

Webform CiviCRM Integration allows you to add CiviCRM fields to a Drupal Webform. The module doesn't sufficiently escape user input. Some of the vulnerabilities are mitigated by the fact that an attacker must have a role with the permission to edit the webform node plus "access CiviCRM" to define...

Drupal Webform Matrix Component Module Cross-Site Scripting Vulnerability

Drupal is the Drupal community maintains a set of free , open-source content management system developed in PHP language . Webform Matrix Component is one of the matrix/tabular input component module provides . A cross-site scripting vulnerability exists in the Drupal Webform Matrix Component...

CVE-2015-5494

Cross-site scripting XSS vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5494

Cross-site scripting XSS vulnerability in the Webform Matrix Component module 7.x-4.x before 7.x-4.13 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-5494

The CVE-2015-5494 entry covers a Cross-Site Scripting (XSS) vulnerability in the Webform Matrix Component module for Drupal (versions 7.x-4.x prior to 7.x-4.13). The issue arises from insufficient sanitization of user-supplied text, allowing remote authenticated users with certain permissions to ...

Fedora Update for drupal7-webform FEDORA-2015-5022

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal Webform module cross-site scripting vulnerability (CNVD-2015-03861)

Drupal is a free and open source content management system developed in PHP. webform is a market research questionnaire module. A cross-site scripting vulnerability exists in the Drupal Webform module processing node header, which allows remote attackers to exploit the vulnerability to inject...

Drupal Webform module cross-site scripting vulnerability (CNVD-2015-03860)

Drupal is a free and open source content management system developed in PHP. webform is a market research questionnaire module. The Drupal Webform module handles view-based webform result forms with a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to...

CVE-2015-4374

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient To address of an ema...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient To address of an ema...

CVE-2015-4374

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.23, 7.x-3.x before 7.x-3.23, and 7.x-4.x before 7.x-4.5 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a component name in the recipient To address of an ema...

CVE-2015-4374

CVE-2015-4374 describes a cross-site scripting (XSS) vulnerability in the Drupal Webform module. The issue allows remote authenticated users with certain permissions to inject arbitrary script/HTML via a component name in the recipient (To) address used for emails sent by Webform. Affected are Dr...

CVE-2015-4384

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-4379

Cross-site request forgery CSRF vulnerability in the Webform Multiple File Upload module 6.x-1.x before 6.x-1.3 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of certain users for requests that delete files via unspecified vectors...

CVE-2015-4357

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...

CVE-2015-4356

Cross-site scripting XSS vulnerability in the view-based webform results table in the Webform module 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a webform...

CVE-2015-4354

Cross-site scripting XSS vulnerability in the Ubercart Webform Integration module before 6.x-1.8 and 7.x before 7.x-2.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Ubercart Webform Checkout Pane module 6.x-3.x before 6.x-3.10 and 7.x-3.x before 7.x-3.11 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in the Webform module before 6.x-3.22, 7.x-3.x before 7.x-3.22, and 7.x-4.x before 7.x-4.4 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a node title, which is used as the default title of a...