CVE-2012-2724

The vulnerability CVE-2012-2724 affects the Drupal Simplenews module (versions 6.x-1.x prior to 6.x-1.4, 6.x-2.x prior to 6.x-2.0-alpha4, and 7.x-1.x prior to 7.x-1.0-rc1). The root cause is information disclosure: when confirmation is required for new subscribers, the confirmation page reveals t...

CVE-2013-4447

The CVE-2013-4447 entry concerns a Cross‑Site Scripting (XSS) flaw in the Drupal Simplenews module API. Affected are Drupal 6.x-1.x lines prior to 6.x-1.5 and Drupal 7.x-1.x lines prior to 7.x-1.1, where an attacker could inject arbitrary scripts or HTML via an email address parameter. The vulner...