CVE-2010-2123

The CVE-2010-2123 entry describes multiple XSS vulnerabilities in Drupal’s Storm module (5.x and 6.x) prior to 6.x-1.33. The root cause is improper handling of user-supplied input in stormorganization, stormperson, stormtask, stormticket, and stormproject actions (via parameters such as fullname,...

CVE-2010-2158

The CVE-2010-2158 entry describes XSS vulnerabilities in the Drupal Storm module (versions 5.x and 6.x prior to 6.x-1.33). The issue is triggered by user-supplied values in the stormperson action, specifically the parameters fullname, phone, or im, which can be exploited by remote authenticated u...

CVE-2009-4515

The Storm module for Drupal (6.x before 6.x-1.25) does not enforce privilege requirements for storminvoiceitem nodes, allowing remote attackers to read node titles via unspecified vectors. This affects confidentiality (partial). No exploit details are provided in the documents. Remediation: upgra...