CVE-2012-2296

The CVE-2012-2296 issue affects the Janrain Engage (formerly RPX) Drupal module. It states that user profile data from Engage is stored in session tables (and also in the users table) for Drupal 6.x-1.x, 6.x-2.x prior to 6.x-2.2, and 7.x-2.x prior to 7.x-2.2, which could enable remote attackers t...

CVE-2011-0771

The CVE-2011-0771 entry concerns the Drupal module Janrain Engage (RPX) 6.x-1.3, which fails to validate the avatar/profile image file. This vulnerability allows remote authenticated users to perform cross-site scripting (XSS) and potentially execute arbitrary PHP code by triggering a crafted ava...