CVE-2013-4274

CVE-2013-4274 affects the Drupal Password Policy contributed module (6.x-1.x and 7.x-1.x branches). The vulnerability is an XSS in password_policy_admin_view, exploitable by remote authenticated users who have the Administer policies permission, via the Password Expiration Warning field on admin/...

CVE-2012-1633

CVE-2012-1633 affects Drupal via the Password Policy module (6.x-1.x prior to 6.x-1.4 and 7.x-1.0 beta3). The vulnerability is a Cross-site Request Forgery (CSRF) that allows remote attackers to hijack the authentication of administrative users for requests that unblock a user. Impact is administ...

CVE-2012-5552

Summary: The Password policy module for Drupal 6.x and 7.x contains a vulnerability where, when the module’s “previous passwords” feature is enabled, an attacker who can view HTTP traffic can obtain a user’s hashed password due to lack of encrypted transport. This affects: Drupal 6.x-1.x prior to...