Lucene search
+L
DrupalMost viewed

1966 matches found

Drupal
Drupal
added 2016/06/08 12:00 a.m.20 views

Page Manager Search - Moderately Critical - Information disclosure - SA-CONTRIB-2016-032

This module enables you to make Panels pages and other pages managed by CTools' Page Manager submodule indexible and searchable through the standard Search module provided in Drupal core. The module doesn't block access to Page Manager pages which have been disabled. CVE identifiers issued ACVE...

7.2AI score
SaveExploits0References12
Drupal
Drupal
added 2016/06/01 12:00 a.m.20 views

Opening hours - Moderately Critical - XSS - SA-CONTRIB-2016-031

This module enables you to enter opening hours for locations in a highly detailed way. The module doesn't sufficiently escape input data from user input. This vulnerability is mitigated by the fact that an attacker must be able to edit opening hours by having a role with the permission “Edit...

7AI score
SaveExploits0References11
Drupal
Drupal
added 2016/05/25 12:00 a.m.20 views

XML Sitemap - Moderately Critical - XSS - SA-CONTRIB-2016-030

The XML Sitemap module enables you to create sitemaps which help search engines to more intelligently crawl a website and keep their results up to date. The module doesn't sufficiently filter the URL when it is displayed in the sitemap. This vulnerability is mitigated if the setting for "Include ...

7.1AI score
SaveExploits0References12
Drupal
Drupal
added 2016/05/18 12:00 a.m.20 views

Dropbox client - Multiple Vulnerabilities - SA-CONTRIB-2016-027

This module enables you to view dropbox files in your Drupal site. The module doesn't sufficiently sanitize filenames when displaying them to users or administrators leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to...

5.1AI score
SaveExploits0References11
Drupal
Drupal
added 2016/04/13 12:00 a.m.20 views

Boost - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-021

This module provides static page caching for Drupal enabling a very significant performance and scalability boost for sites that receive mostly anonymous traffic. The module doesn't prevent form cache from leaking between anonymous users which could result in information disclosure, where one use...

6.7AI score
SaveExploits0References13
Drupal
Drupal
added 2016/03/02 12:00 a.m.20 views

USASearch - Moderately Critical - Access Bypass - SA-CONTRIB-2016-010

This module indexes public content using USASearch, a program of the General Services Administration’s Office of Citizen Services and Information Technology OCSIT, which offers free search services to any federal, state, local, tribal, or territorial government agency that can be used to search o...

7.1AI score
SaveExploits0References13
Drupal
Drupal
added 2016/03/02 12:00 a.m.20 views

Google Analytics Counter - Moderately Critical - CSRF - SA-CONTRIB-2016-011

The Google Analytics Counter module provides total pageview counts for each page on a website. In that it is similar to the core Statistics module counter, but it is much lighter and ultimately faster because it draws on data from Google Analytics. This is why it is also able to effortlessly coun...

7AI score
SaveExploits0References12
Drupal
Drupal
added 2016/01/13 12:00 a.m.20 views

RedHen CRM - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-002

The Redhen set of modules allows you to build a CRM features in a Drupal site. When rendering individual Contacts, this module does not properly filter the certain data prior to display. When rendering listing of notes or engagement scores, these modules do not properly filter certain data before...

5.4CVSS5.4AI score0.00615EPSS
SaveExploits0References11
Drupal
Drupal
added 2015/12/16 12:00 a.m.20 views

Select2 Field Widget - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-173

Select2 Field Widget module enables you to use the select2 library for field widgets. The module doesn't sufficiently sanitize some user supplied text, leading to a reflected Cross Site Scripting vulnerability XSS. CVE identifiers issued ACVE identifier will be requested, and added upon issuance,...

6.7AI score
SaveExploits0References14
Drupal
Drupal
added 2015/12/02 12:00 a.m.20 views

Apache Solr Search - Moderately Critical - Access Bypass - SA-CONTRIB-2015-170

This module enables you to connect to an Apache Solr search server to provide a replacement for Drupal core content search and provide both extra features and better search performance and relevance. The module doesn't correctly check access when attempting to delete non-default search...

7AI score
SaveExploits0References13
Drupal
Drupal
added 2015/12/02 12:00 a.m.20 views

RESTful - Less Critical - Access bypass - SA-CONTRIB-2015-167

RESTful module allows Drupal to be operated via RESTful HTTP requests, using best practices for security, performance, and usability. The module doesn't sufficiently validate some user input. Specific code could be run arbitrarily by an attacker in certain circumstances. This vulnerability is...

7.2AI score
SaveExploits0References11
Drupal
Drupal
added 2015/12/02 12:00 a.m.20 views

Mollom - Critical - Access bypass - SA-CONTRIB-2015-168

The Mollom module allows users to protect their website from spam. As part of the spam protection, Mollom enables the website administrator to create a blacklist. When content is submitted that matches terms on the black list it will be automatically marked as spam and rejected per the site...

7.5CVSS7.5AI score0.01291EPSS
SaveExploits0References10
Drupal
Drupal
added 2015/11/04 12:00 a.m.20 views

Monster Menus - Access Bypass - Moderately Critical - SA-CONTRIB-2015-163

Monster Menus is a hierarchical menu tree, which provides highly scalable, granular permissions for all pages within a site. The module includes an option to remove nodes from view add them to a "recycle bin" rather than deleting them outright. When a node has been put into a bin using an affecte...

5CVSS6.2AI score0.01196EPSS
SaveExploits0References9
Drupal
Drupal
added 2015/10/28 12:00 a.m.20 views

Field as Block - Less Critical - Information Disclosure - SA-CONTRIB-2015-161

This module enables you to take a field from the current entity and place it elsewhere as a block. The module caches the block output in a manner that could allow sensitive content to be seen by visitors who should not see it. The problem will only occur when other modules alter field output base...

5CVSS6.2AI score0.01196EPSS
SaveExploits0References11
Drupal
Drupal
added 2015/10/21 12:00 a.m.20 views

Webform CiviCRM Integration - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-160

Webform CiviCRM Integration allows you to add CiviCRM fields to a Drupal Webform. The module doesn't sufficiently escape user input. Some of the vulnerabilities are mitigated by the fact that an attacker must have a role with the permission to edit the webform node plus "access CiviCRM" to define...

7.2AI score
SaveExploits0References13
Drupal
Drupal
added 2015/08/05 12:00 a.m.20 views

Compass Rose - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-138

Compass Rose module provides a type of CCK field that allows to represent the most common orientations North, North-East, East, South-East, South, South-West, West and North-West. The module was embedding a JavaScript library from an external source that was not reliable, thereby exposing the sit...

6.1CVSS6.1AI score0.01271EPSS
SaveExploits0References10
Drupal
Drupal
added 2015/07/01 12:00 a.m.20 views

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131

The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows. The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled suc...

4.9CVSS6.3AI score0.0161EPSS
SaveExploits0References10
Drupal
Drupal
added 2015/04/22 12:00 a.m.20 views

Node Template - Moderately Critical - Cross Site Request Forgery (CSRF) - Unsupported - SA-CONTRIB-2015-099

Node Template module enables you to define any node as a node template and it can be duplicated later. The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause a user with "access node template" permission to delete node templates by getting their browser to make...

6.8CVSS6.3AI score0.00581EPSS
SaveExploits0References8
Drupal
Drupal
added 2015/03/18 12:00 a.m.20 views

SA-CONTRIB-2015-080 - Profile2 Privacy - Cross Site Scripting (XSS)

Profile2 Privacy module enables you to show or hide parts of a profile2 entity based on pre-configured field sets with a title and description. The module doesn't sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is...

3.5CVSS6.1AI score0.00965EPSS
SaveExploits0References11
Drupal
Drupal
added 2015/03/04 12:00 a.m.20 views

SA-CONTRIB-2015-072 - Commerce Ogone - Access bypass

This module enables you to use Ogone Ingenico as a payment method for Drupal Commerce. Malicious users can trick Commerce Ogone into proceeding with the checkout process without actually going through the Ogone payment process, causing the order status to be set to checkout complete, even though ...

5CVSS6.4AI score0.01358EPSS
SaveExploits0References12
Drupal
Drupal
added 2015/02/11 12:00 a.m.20 views

SA-CONTRIB-2015-046 - Taxonomy Tools - Cross Site Scripting (XSS)

Taxonomy Tools module provides alternative ways of managing taxonomy terms. The module doesn't sufficiently escape node and taxonomy term titles when displaying them, allowing a malicious user to inject code. This vulnerability is mitigated by the fact that an attacker must have a role with...

3.5CVSS6.3AI score0.00946EPSS
SaveExploits0References12
Drupal
Drupal
added 2015/01/28 12:00 a.m.20 views

SA-CONTRIB-2015-033 - Certify - Access bypass and information disclosure

Certify enables you to automatically issue PDF certificates to users upon completion of a set of conditions. The module does not sufficiently check node access when showing and creating the PDF certificates. This can lead to users seeing certificates they should not have access to. This...

4CVSS6.3AI score0.00685EPSS
SaveExploits0References11
Drupal
Drupal
added 2014/09/10 12:00 a.m.20 views

SA-CONTRIB-2014-086 - Custom BreadCrumbs - Cross Site Scripting (XSS)

Custom Breadcrumbs allows administrators to set up parametrized breadcrumb trails for different content types, views, panels, taxonomy vocabularies and terms, paths, and a simple API that allows contributed modules to enable custom breadcrumbs for module pages and theme templates. User input is n...

5.4AI score
SaveExploits0References12
Drupal
Drupal
added 2014/07/02 12:00 a.m.20 views

SA-CONTRIB-2014-068 - Pane - XSS

This module did not properly sanitize content entered for title. It allowed sufficiently privileged users to add arbitrary HTML which could result in XSS attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks" or ability to ed...

6.1AI score
SaveExploits0References12
Drupal
Drupal
added 2014/05/28 12:00 a.m.20 views

SA-CONTRIB-2014-058 - Webserver Auth - Access Bypass

This module allows you to delegate user authentication to the web server. The module can be configured to automatically create users that have been authenticated by the web server. There was an issue where a configuration variable did not have consistent default values in the code meaning that in...

7.3AI score
SaveExploits0References12
Drupal
Drupal
added 2014/03/12 12:00 a.m.20 views

SA-CONTRIB-2014-031 - Webform Template - Access Bypass

This module enables you to copy webform config from one node to another. The module doesn't respect node access when providing possible nodes to copy from. As a result, a user may be disclosed the titles of nodes he does not have view access to and as such he may be able to copy the webform...

6.8AI score
SaveExploits0References11
Drupal
Drupal
added 2014/02/05 12:00 a.m.20 views

SA-CONTRIB-2014-009 - Tagadelic - Information Disclosure

This module provides an API and a few simple turnkey modules, which allows you to easily create tagclouds, weighted lists, search-clouds and such. The 6.x-1.x version does not account for node access modules, thus leading to information being disclosed. This vulnerability is mitigated by the fact...

6.7AI score
SaveExploits0References13
Drupal
Drupal
added 2013/11/13 12:00 a.m.20 views

SA-CONTRIB-2013-090 - Revisioning - Access Bypass

This module enables you to create content publication workflows whereby one version of the content is "live" publicly visible, while another is being edited and moderated privately until found fit for publication. The module doesn't sufficiently apply node access permissions when used in...

4CVSS6.1AI score0.01082EPSS
SaveExploits0References10
Drupal
Drupal
added 2013/10/23 12:00 a.m.20 views

SA-CONTRIB-2013-081 - Spaces - Access bypass

This module enables you to make configuration options generally available only at the sitewide level to be configurable and overridden by individual "spaces" on a Drupal site. The spaces submodule, Spaces OG, doesn't properly handle deleting of organic group group spaces when the option to move t...

2.1CVSS6.2AI score0.00946EPSS
SaveExploits0References8
Drupal
Drupal
added 2013/10/23 12:00 a.m.20 views

SA-CONTRIB-2013-082 - Bean - Cross Site Scripting (XSS)

This module enables you to create block entities a.k.a. beans. The module did not sufficiently filter bean titles for dangerous html. This vulnerability is mitigated by the fact that an attacker must have permission to create or edit beans. CVE identifiers issued CVE-2013-4499 Versions affected...

4.3CVSS6.3AI score0.01148EPSS
SaveExploits0References9
Drupal
Drupal
added 2013/08/28 12:00 a.m.20 views

SA-CONTRIB-2013-072 - Node View Permissions - Access Bypass

The Node View Permissions module adds permissions "View own content" and "View any content" for each content type on the permissions page. However, it only implements hooknodeaccess and not hookqueryalter, which means any listing of nodes does not respect the node view permission. CVE identifiers...

6.5AI score
SaveExploits0References10
Drupal
Drupal
added 2013/03/27 12:00 a.m.20 views

SA-CONTRIB-2013-036 - Zero Point - Cross Site Scripting (XSS)

Zero Point is a theme which includes many options, ideal for a wide range of sites. The theme does not escape user supplied text which creates a reflected Cross site scripting XSS vulnerability in URLs. There are no mitigating factors. CVE identifiers issued CVE-2013-1905 Versions affected...

4.3CVSS5.5AI score0.02227EPSS
SaveExploits0References9
Drupal
Drupal
added 2013/02/20 12:00 a.m.20 views

SA-CONTRIB-2013-022 - Menu Reference - Cross site scripting (XSS)

Module Menu Reference doesn't escape HTML that contains menu link title displayed in Menu Reference "Rendered links" formatter. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer menus and menu items" to insert HTML code in menu link titl...

2.1CVSS6.3AI score0.00941EPSS
SaveExploits0References9
Drupal
Drupal
added 2013/02/20 12:00 a.m.20 views

SA-CONTRIB-2013-018 - Taxonomy Manager - Cross Site Request Forgery (CSRF)

The Taxonomy Manager provides an advanced interface for administrating taxonomy vocabularies. The module doesn't sufficiently verify POST requests thereby exposing a Cross Site Request Forgery vulnerability. This vulnerability is mitigated by the fact that an attacker must trick a user with...

5.1CVSS6.3AI score0.00684EPSS
SaveExploits0References9
Drupal
Drupal
added 2012/10/03 12:00 a.m.20 views

SA-CONTRIB-2012-150 - Twitter Pull - Cross Site Scripting (XSS)

Twitter Pull allows you to retrieve tweets from Twitter based on a user or search and display them on your site. It also includes integration with the boxes module to allow for simple placement of twitter feeds on various pages. The module doesn't sufficiently filter the data coming from Twitter...

4.3CVSS6AI score0.01161EPSS
SaveExploits0References11
Drupal
Drupal
added 2012/09/19 12:00 a.m.20 views

SA-CONTRIB-2012-142 - Spambot - Cross Site Scripting (XSS)

The Spambot module enables you to protect new user registrations from spammers using the database at stopforumspam.com. Spambot doesn't sufficiently sanitize API responses from stopforumspam.com when they are logged to the watchdog, allowing a potential XSS attack. This vulnerability is mitigated...

2.6CVSS5.8AI score0.01319EPSS
SaveExploits0References12
Drupal
Drupal
added 2012/09/12 12:00 a.m.20 views

SA-CONTRIB-2012-141 - Mass Contact - Access bypass

This module allows anyone with permission to send a single message to multiple users of a site, using its roles functionality. The module doesn't sufficiently check permissions after the form has been submitted. This vulnerability is mitigated by the fact that an attacker must use a tool of some...

6.8AI score
SaveExploits0References9
Drupal
Drupal
added 2012/08/29 12:00 a.m.20 views

SA-CONTRIB-2012-134 - Views - Privilege Escalation

The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. The module incorrectly modifies the global user object in some situations when a view has a uid argument and performs validation on...

6.9AI score
SaveExploits0References10
Drupal
Drupal
added 2012/07/11 12:00 a.m.20 views

SA-CONTRIB-2012-106 - Listhandler - Access Bypass

Listhandler is a module that marries mailing list discussions and Drupal forums. The module doesn't sufficiently check the permissions of comment authors when importing emails. CVE: CVE-2012-4470 Versions affected All Listhandler 6.x-1.x versions. Drupal core is not affected. If you do not use th...

7.5CVSS6.5AI score0.01304EPSS
SaveExploits0References8
Drupal
Drupal
added 2012/06/06 12:00 a.m.20 views

SA-CONTRIB-2012-092 - Organic Groups - Cross Site Scripting (XSS) and Access Bypass

The Organic Groups module enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. Cross Site Scripting The module doesn't sufficiently filter user supplied text when used in connectio...

5.7AI score
SaveExploits0References12
Drupal
Drupal
added 2012/05/02 12:00 a.m.20 views

SA-CONTRIB-2012-068 - Node Gallery - Cross Site Request Forgery (CSRF) - Unsupported

CVE: CVE-2012-2305 Node gallery enable users to create a more flexible and powerful gallery that are fully integrated with Drupal's core node system. This module does not protect a CSRF attack when creating node galleries. Versions affected 6.x-3.1 and before Drupal core is not affected. If you d...

6.8CVSS6.5AI score0.00636EPSS
SaveExploits0References8
Drupal
Drupal
added 2012/05/02 12:00 a.m.20 views

SA-CONTRIB-2012-070 - Taxonomy Grid : Catalog - Cross Site Scripting (XSS) - Unsupported

CVE: CVE-2012-2308 This module provides a page where you can see each content types you've selected under terms from vocabularies you've selected. This module does not properly filter user supplied text resulting in a Cross Site scripting bug. This vulnerability is mitigated by the fact that an...

3.5CVSS6AI score0.00946EPSS
SaveExploits0References8
Drupal
Drupal
added 2012/04/11 12:00 a.m.20 views

SA-CONTRIB-2012-059 - Autosave - Cross Site Request Forgery

CVE: CVE-2012-2097 This module enables snapshots of your node edit form to be saved in the background while you are editing to help prevent the data from being lost. The module doesn't sufficiently protect against a user being tricked into submitting saved results to a node. Versions affected...

6.8CVSS6.3AI score0.00933EPSS
SaveExploits1References11
Drupal
Drupal
added 2012/03/28 12:00 a.m.21 views

SA-CONTRIB-2012-043 - MultiBlock - Cross Site Scripting

CVE: CVE-2012-2070 The MultiBlock module allows an administrator to create multiple instances of blocks provided by other modules. The module does not properly sanitize the block title provided by a block administrator, leading to a cross-site scripting XSS vulnerability. Such an attack may lead ...

2.1CVSS5.6AI score0.01318EPSS
SaveExploits1References12
Drupal
Drupal
added 2012/03/28 12:00 a.m.20 views

SA-CONTRIB-2012-050 - CDN2 Video - Unsupported

CDN2 is a plug and play module and video management service for Drupal. The module does not sanitize output correctly, allowing for a cross-site scripting XSS vulnerability. Additionally, the Form API is not correctly utilized allowing for cross-site request forgery CSRF attempts. This module...

6.8CVSS5.6AI score0.01284EPSS
SaveExploits0References7
Drupal
Drupal
added 2012/03/14 12:00 a.m.20 views

SA-CONTRIB-2012-039 - Language Icons - Cross Site Scripting (XSS)

CVE: CVE-2012-2065 The Language icons module adds icons to language links generated by the Locale and Content Translation modules in core. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is...

3.5CVSS5.6AI score0.01822EPSS
SaveExploits0References12
Drupal
Drupal
added 2011/11/09 12:00 a.m.20 views

SA-CONTRIB-2011-053 - Quiz - Cross Site Scripting

Quiz module allows the creation and taking of tests that are scored either automatically or manually by a teacher. The module contains several cross site scripting XSS vulnerabilities that can be exploited when quizzes are being created. These vulnerabilities are mitigated by the fact that an...

6.1AI score
SaveExploits0References11
Drupal
Drupal
added 2011/10/12 12:00 a.m.20 views

SA-CONTRIB-2011-049 - Cumulus - Cross Site Scripting (XSS)

The Cumulus module allows you to display your site's tags using a 3D Flash animation. The module ships with a Flash file cumulus.swf that contains a cross site scripting XSS vulnerability that can be exploited when a user is made to view a specially crafted URL. If the user is logged in to an...

5.9AI score
SaveExploits0References9
Drupal
Drupal
added 2011/10/05 12:00 a.m.20 views

SA-CONTRIB-2011-045 - Rate module Cross Site Scripting

The Rate module provides flexible rate widgets. These widgets are refreshed via AJAX after voting. The AJAX callback does not correctly handle certain arguments obtained from the URL. By enticing a suitably privileged user to visit a specially crafted URL, a malicious user is able to insert...

6.5AI score
SaveExploits0References11
Drupal
Drupal
added 2011/05/18 12:00 a.m.20 views

SA-CONTRIB-2011-021 - Webform - Multiple Vulnerabilities

Webform module enables you to create custom webform or survey nodes. These nodes typically may be created either by editorial teams or administrators. Webform does not sufficiently check directory access when a user configures an upload field. This may allow a user to upload malicious files to th...

6.2AI score
SaveExploits0References13
Total number of security vulnerabilities1966