SA-CONTRIB-2015-065 - Registration codes - Multiple vulnerabilities

Registration codes module allows new account registrations only for users who provide a valid registration code. The module was not properly sanitizing user supplied text in some pages, thereby exposing XSS vulnerabilities. Additionally, some URLs were not protected against CSRF, a malicious user...

SA-CONTRIB-2015-007 - Htaccess - Cross Site Request Forgery (CSRF)

The Htaccess module allows the creation and deployment of .htaccess files based on custom settings. Some administration links were not properly protected from Cross Site Request Forgery CSRF. A malicious user could cause an administrator to deploy or delete .htaccess files by getting the...

SA-CONTRIB-2014-115 - Form Builder - Cross-Site Scripting (XSS)

The Form Builder module enables users to build entire Form API structures through a graphical, AJAX-like interface. The module doesn't sufficiently sanitize form titles in some cases. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create forms...

SA-CONTRIB-2014-103 - Passwordless - Cross Site Scripting (XSS)

This module replaces the regular Drupal login form with a modification of the password-request form, to give the possibility to log in without using a password. The module doesn't sufficiently sanitize user-generated text entered in the module's configuration form. This vulnerability is mitigated...

SA-CONTRIB-2014-101 - Ubercart - Cross Site Request Forgery

The Ubercart module provides a shopping cart and e-commerce features for Drupal. Cross Site Request Forgery CSRF The country administration links are not properly protected. A malicious user could trick a store administrator into enabling or disabling a country by getting them to visit a...

SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS)

OAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication. Within its API code the Client class exposes variables in an error message, which originate from a third party source without proper sanitisation thus leading to a Cross Site Scripti...

SA-CONTRIB-2014-102 - Document - Cross Site Scripting

Document module is a basic Document Management System for Drupal. Cross Site Scripting XSS The module wasn't sanitizing user input sufficiently in a few use cases. This vulnerability is mitigated by the the fact that a user must have permissions to add or edit documents to be able to exploit the...

SA-CONTRIB-2014-057 - Password policy - General logic error

This module enables you to define password policies with various constraints on allowable user passwords. The history constraint, when enabled, disallows a user's password from being changed to match a specified number of their previous passwords. Beginning with Password Policy 7.x-1.4, the histo...

SA-CONTRIB-2014-053 - Field API Tab Editor (FATE) - Access bypass

This module allows each entity field to be individually edited via its own custom page, accessible via a tab on the entity's page. The module returns an incorrect value to hookmenu if the current user does not have access to edit the entity. This allows users who would not normally have access to...

SA-CONTRIB-2014-049 - Organic Groups (OG) - Access Bypass

Organic groups OG enables users to create and manage their own 'groups'. Each group can have subscribers, and maintains a group home page where subscribers communicate amongst themselves. OG doesn't sufficiently check the permissions when a group member is pending or blocked status within the gro...

SA-CONTRIB-2014-045 - Drupal Commons - Multiple Vulnerabilities

This SA contains two patches against Drupal Commons Views Bulk Operations Access Bypass Drupal commons comes with a view to moderate reported content, which is intended for authenticated users to view which content has been reported. Since it has hard coded VBO operations within the view, and...

SA-CONTRIB-2014-041 - Block Search - SQL Injection

Block Search module provides an alternative way of managing blocks. The module doesn't properly use Drupal's database API resulting in user-provided strings being passed directly to the database allowing SQL Injection. This vulnerability is mitigated by the fact that an attacker must either use a...

SA-CONTRIB-2014-015 - FileField - Access Bypass

FileField module allows users to upload files with in conjunction with the Content Construction Kit CCK module in Drupal 6. The module doesn't sufficiently check permissions on revisions when determining if a user should have access to a particular file attached to that revision. A user could gai...

SA-CONTRIB-2014-009 - Tagadelic - Information Disclosure

This module provides an API and a few simple turnkey modules, which allows you to easily create tagclouds, weighted lists, search-clouds and such. The 6.x-1.x version does not account for node access modules, thus leading to information being disclosed. This vulnerability is mitigated by the fact...

SA-CONTRIB-2014-005 - Leaflet - Access bypass

The Leaflet module enables you to display an interactive map using the Leaflet library, using entities as map features. The module exposes complete data from entities used as map features to any site visitor with a Javascript inspector like Firebug. CVE identifiers issued ACVE identifier will be...

SA-CONTRIB-2013-059 - Hostmaster (Aegir) - Access Bypass

This install profile and accompanying suite of modules enables you to install, upgrade, deploy, and backup Drupal sites among other things. The module doesn't sufficiently control access to running tasks on sites, under the scenario where a user successfully guesses a sites' path in the Aegir...

SA-CONTRIB-2013-008 - CurvyCorners - Cross Site Scripting (XSS) - module unsupported

The CurvyCorners module enables you to create rounded corners on HTML block elements. The module doesn't sufficiently filter user entered text when being displayed. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer curvycorners". CVE...

SA-CONTRIB-2012-121 - Shorten URLs - Cross Site Scripting (XSS)

The Shorten URLs module provides an API to shorten URLs via many services like bit.ly and TinyURL, as well as a block and a page that provide an interface for easily shortening URLs. Cross Site Scripting via report The module doesn't sufficiently sanitize user input when displaying shortened URLs...

SA-CONTRIB-2012-068 - Node Gallery - Cross Site Request Forgery (CSRF) - Unsupported

CVE: CVE-2012-2305 Node gallery enable users to create a more flexible and powerful gallery that are fully integrated with Drupal's core node system. This module does not protect a CSRF attack when creating node galleries. Versions affected 6.x-3.1 and before Drupal core is not affected. If you d...

SA-CONTRIB-2011-059 - Meta tags quick - Cross Site Scripting (XSS)

The Meta tags quick module provides a simple tool to add meta tags to a site. The module doesn't consistently filter user input which could lead to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer...

SA-CONTRIB-2011-041 - Hostmaster (Aegir) - Cross Site Scripting

Hostmaster Aegir provides a system for managing Drupal sites. The theme in Hostmaster, Eldir, does not sanitize the custom body classes correctly leading to a cross site scripting XSS vulnerability that can be exploited when a user is made to view a specially crafted URL. If the user is logged in...

SA-CONTRIB-2011-037- Node Invite - Cross Site Scripting

The Node Invite module allows you to invite users with existing accounts or otherwise to specified nodes on a Drupal site. This module does not properly use t strings to ensure all text was sanitized when data was output through a formseterror message, thus creating a Cross Site Scripting XSS...

SA-CONTRIB-2011-035 Forward module - Open redirect

The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module doesn't check to ensure that the page being forwarded refers to an internal path. This could allow someone to hard...

SA-CONTRIB-2011-021 - Webform - Multiple Vulnerabilities

Webform module enables you to create custom webform or survey nodes. These nodes typically may be created either by editorial teams or administrators. Webform does not sufficiently check directory access when a user configures an upload field. This may allow a user to upload malicious files to th...

SA-CONTRIB-2011-017 - Save Draft - Validation Bypass

The Save Draft module adds a "Save as draft" button to the node form, letting content creators easily save a post in unpublished draft form. The module adds validation to individual form actions, thereby bypassing any form-wide validation that is normally performed before saving content. This is ...

SA-CONTRIB-2011-016 - Node Quick Find - Information Disclosure

The Node Quick Find module provides a block to quickly access nodes by title via an auto-completing text field. The module does not use dbrewritesql when generating the list of node titles, allowing users to see the titles of nodes to which they may not have access. Access to the node itself is n...

SA-CONTRIB-2011-014 - Webform Block - Cross Site Scripting

The Webform Block module enables users to make a webform available as a block. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting XSS vulnerability that may lead to a malicious user gaining full administrative access. The...

SA-CONTRIB-2011-009 - Droptor - SQL Injection

The Droptor module connects a Drupal site to Droptor.com, a Drupal monitoring and management solution. When capturing memory logging information the module does not filter the value input from the current page request variable. This vulnerability can be exploited to perform an SQL Injection attac...

SA-CONTRIB-2010-102 - Category tokens - Cross Site Scripting

The Category tokens module exposes additional tokens for the first and last terms related to a node for each vocabulary. The module does not sanitize the vocabulary names when displayed in token help, leading to a Cross-Site Scripting XSS vulnerability that may lead to a malicious user gaining fu...

SA-CONTRIB-2010-094 - Embedded Media Field - Access bypass

The Embedded Media Field project is a set of modules that enable editors to post URL's and embed codes for third party media providers such as YouTube, Vimeo, or Flickr, which will be automatically parsed and displayed using preset formatters. The Embedded Video Field module packaged with the...

SA-CONTRIB-2010-087 - GovDelivery - Cross site scripting

The GovDelivery module provides integration with the GovDelivery On-Demand Mailer service, a web service for GovDelivery customers that sends messages directly based on configured account information. The module replaces the backend of SMTP library in your Drupal site with calls to the GovDeliver...

SA-CONTRIB-2010-074 - Drupad - Cross-site request forgery

The Drupad module is the companion module of the iPhone / iPodTouch application also called Drupad. The module doesn't check if the incoming request is made from the application, leading to a CSRF vulneraby. This vulnerability can be used to delete users and content, or set the site in offline mo...

SA-CONTRIB-2010-063 - Studio theme pack - Cross Site Scripting

Studio theme pack is a set of themes for use as a base in creating a new theme. The Canvas-theme, part of Studio theme pack and used as base theme for the Workspace and Paint themes, also included in Studio theme pack, does not sanitize some of the user-supplied data before displaying it, leading...

SA-CONTRIB-2010-066 - FileField - Cross Site Scripting

FileField module integrates with the Content Construction Kit to provide a file upload field. It also integrates with the Views and Token modules. The module does not sanitize some of the user-supplied data before displaying it for Drupal 6.x-3.x only, or before adding it to tokens both 5.x-2.x a...

SA-CONTRIB-2010-057 - Rotor Banner - Cross Site Scripting (XSS)

The Rotor Banner module allows users to upload images which can then be displayed in a block and rotated through using jQuery. However, when these images are displayed, the values for the various image attributes srs, title, alt are not properly sanitized, leading to a cross site scripting XSS...

SA-CONTRIB-2010-050 - CAPTCHA - Cross Site Scripting

The CAPTCHA module enables a site administrator to put a CAPTCHA form element a simple challenge that is easy for humans, but hard for automated spam bots on any form. The CAPTCHA module does not sanitize the CAPTCHA description that is added as help text to the CAPTCHA form element, allowing use...

SA-CONTRIB-2010-032 - Taxonomy Breadcrumb - Cross Site Scripting (XSS)

The Taxonomy Breadcrumb module generates taxonomy based breadcrumbs on node pages and taxonomy/term pages. This module does not properly sanitize taxonomy term name and, for 6.x, node titles when displayed in breadcrumbs, leading to a Cross Site Scripting XSS vulnerability. XSS vulnerabilities ma...

SA-CONTRIB-2010-012 - ODF Import - Access Bypass (possible Cross Site Scripting)

ODF Import module enables users of a Drupal site to import content created in the ODF format e.g. using OpenOffice.org. When importing content it always used an input format which might not be available to the user importing the content leading to a cross-site scripting XSS vulnerability. Such an...

SA-CONTRIB-2010-003 - Forward - Cross site scripting

This module allows users to forward a link to a specific node on your site to a friend. The Forward module does not properly sanitize user supplied data, allowing users with the "access administration pages" and "administer forward" permissions, or users with "access administration pages" and...

SA-CONTRIB-2009-104 - Feed Element Mapper - Cross Site Scripting

Feed Element Mapper is an add-on module for FeedAPI that maps elements on a feed item such as tags, or the author name, to taxonomy or CCK fields. These mappings are configurable by a point and click interface. When configuring the mapping, some values coming from external feeds are not sanitized...

SA-CONTRIB-2009-091 - Node Hierarchy - Cross Site Scripting

The Node Hierarchy module enables a site administrator to arrange their site into a tree-like structure. When displaying the list of children for a node the module does not properly sanitize the titles of the child nodes before outputting them, leading to a cross-site scripting XSS vulnerability...

SA-CONTRIB-2009-095 - Smartqueue OG - Access Bypass

The Smartqueueog module uses Nodequeue's Smartqueue API to provide a Nodequeue for organic groups which is editable by members of that group or the group's administrators. Users with the "administer nodequeue" permission have the option to batch create subqueues individual instances of a queue fo...

SA-CONTRIB-2009-083 - CCK Comment Reference - Access Bypass

The CCK Comment Reference module enables administrators to define node fields that are references to comments. Users can access comments through the autocomplete path that the module provides even if they don't have access to read comments. Versions affected CCK Comment Reference module versions...

SA-CONTRIB-2009-081 - Abuse - Cross Site Scripting

The Abuse module enables users to flag nodes and comments as offensive, bringing them to the attention of the site maintainer for review. The module suffers from a Cross Site Scripting Cross Site Scripting vulnerability. Such an attack may lead to a malicious user gaining full administrative...

SA-CONTRIB-2009-080 - Simplenews Statistics - Multiple vulnerabilities

The Simplenews Statistics module provides newsletter statistics such as the open rate and CTR click-through rate. The module suffers multiple vulnerabilities, including Cross Site Request Forgeries CSRF, Cross Site Scripting problem Cross Site Scripting and Open Redirect. This problem allows an...

DRUPAL-SA-CONTRIB-2009-077 - Userpoints - Information disclosure

The Userpoints module enables the users of a site to gain or lose points based on their activity. There is a vulnerability in the module which allows any user with the "View own userpoints" permission to view the userpoints data of any user, not just their own. Versions affected Userponts module...

SA-CONTRIB-2009-070 - Shibboleth authentication - Impersonation, privilege escalation

The Shibboleth authentication module provides user authentication and authorisation based on the Shibboleth Web Single Sign-on system. The module does not properly handle the changes of the underlying Shibboleth session. This can result in impersonation and possible privilege escalation if a user...

SA-CONTRIB-2009-068 - Boost - Filesystem Directory Creation

The Boost module provides a static file-based cache of Drupal pages for anonymous users. A vulnerability in the module allows an attacker to create new directories inside the webroot that the web server can write to. Existing directories cannot be changed using this vulnerability, but it can be...

SA-CONTRIB-2009-057 - Date - Cross Site Scripting

The Date module provides a date CCK field that can be added to any content type. The Date module does not properly escape user data correctly in some cases when setting the page title. A malicious user with permission to post date content could attempt a cross site scripting XSS attack when...

SA-CONTRIB-2009-048 - Bibliography Module - Cross Site Scripting

The Bibliography module Biblio allows users to manage and display lists of scholarly publications. The module contains a cross site scripting vulnerability because it does not properly sanitize output of titles before display. A user who has the permission to create content displayed by the...