drupal token module vulnerabilities and exploits

(subscribe to this query)

NA

Multiple cross-site scripting (XSS) vulnerabilities in the Token module prior to 4.7.x-1.5, and 5.x prior to 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote auth...

Drupal Drupal 5.2 Drupal E-commerce Module Drupal Token Module Drupal Asin Field Module Drupal Drupal 4.7 Drupal Node Relativity Module Drupal Pathauto Module Drupal Drupal 5.0 Drupal Drupal 5.1 Drupal Paypal Node Module Drupal Ubercart Module Drupal Fullname Field For Cck Drupal Invite Module

NA

The Token Insert Entity module 7.x-1.x prior to 7.x-1.1 for Drupal does not properly check permissions, which allows remote authenticated users with certain permissions to bypass intended access restrictions and possibly obtain sensitive information by inserting a token, which em...

Token Insert Entity Project Token Insert Entity 7.x-1.0

NA

The Ubercart Payflow module for Drupal does not use a secure token, which allows remote malicious users to forge payments via unspecified vectors.

Paypal Ubercart Payflow -

NA

The Amazon AWS module prior to 7.x-1.3 for Drupal uses the base URL and AWS access key to generate the access token, which makes it easier for remote malicious users to guess the token value and create backups via a crafted URL.

Amazon Aws Project Amazon Aws

NA

The Token Authentication (tokenauth) module 6.x-1.x prior to 6.x-1.7 for Drupal does not properly revert user sessions, which might allow remote malicious users to perform requests with extra privileges.

Adam Ross Tokenauth 6.x-1.x Adam Ross Tokenauth 6.x-1.5 Adam Ross Tokenauth 6.x-1.6 Adam Ross Tokenauth 6.x-1.3 Adam Ross Tokenauth 6.x-1.4 Adam Ross Tokenauth 6.x-1.0 Adam Ross Tokenauth 6.x-1.1

NA

The Webform module 5.x prior to 5.x-2.8 and 6.x prior to 6.x-2.8, a module for Drupal, does not prevent caching of a page that contains token placeholders for a default value, which allows remote malicious users to read session variables via unspecified vectors.

NA

Cross-site scripting (XSS) vulnerability in the Entity API module prior to 7.x-1.6 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a field label in the Token API.

Entity Api Project Entity Api

NA

The json rendering functionality in the Context module 6.x-2.x prior to 6.x-3.2 and 7.x-3.x prior to 7.x-3.0 for Drupal uses Drupal's token scheme to restrict access to blocks, which makes it easier for remote authenticated users to guess the access token for a block by leve...

Steven Jones Context 7.x-3.0 Steven Jones Context 6.x-3.x Steven Jones Context 6.x-3.0 Steven Jones Context 6.x-2.0 Steven Jones Context 7.x-3.x Steven Jones Context 6.x-3.1

NA

Cross-site scripting (XSS) vulnerability in the Workflow module 5.x-2.x prior to 5.x-2.6 and 6.x-1.x prior to 6.x-1.4 for Drupal, when used with the Token module, might allow remote authenticated users to inject arbitrary web script or HTML via a certain Comment field.

John Vandyk Workflow 5.x-2.x John Vandyk Workflow 5.x-2.5 John Vandyk Workflow 6.x-1.0 John Vandyk Workflow 5.x-2.1 John Vandyk Workflow 5.x-2.0 John Vandyk Workflow 5.x-2.3 John Vandyk Workflow 5.x-2.2 John Vandyk Workflow 6.x-1.2 John Vandyk Workflow 6.x-1.1 John Vandyk Workflow 5.x-2.4 John Vandyk Workflow 6.x-1.4 John Vandyk Workflow 6.x-1.3 John Vandyk Workflow 6.x-1.x-dev

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook