Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2015-3333 State: PUBLISHED Published: 2015-04-19T10:00:00 Last Updated: 2024-08-06T05:47:57.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple unspecified vulnerabilities in Google V8 before 4.2.77.14, as used in Google Chrome before 42.0.2311.90, allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://ubuntu.com/usn/usn-2570-1 - http://www.debian.org/security/2015/dsa-3238 - http://www.securityfocus.com/bid/74221 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html - http://googlechromereleases.blogspot.com/2015/04/stable-channel-upd
pensuse.org/opensuse-updates/2015-04/msg00040.html - http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
CVE ID: CVE-2015-3334 State: PUBLISHED Published: 2015-04-19T10:00:00 Last Updated: 2024-08-06T05:47:57.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: browser/ui/website_settings/website_settings.cc in Google Chrome before 42.0.2311.90 does not always display "Media: Allowed by you" in a Permissions table after the user has granted camera permission to a web site, which might make it easier for user-assisted remote attackers to obtain sensitive video data from a device's physical environment via a crafted web site that turns on the camera at a time when the user believes that camera access is prohibited. Additional Analyst Notes: - CVE Program Container: References: - http:/
user believes that camera access is prohibited. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74225 - https://code.google.com/p/chromium/issues/detail?id=433170 - http://www.debian.org/security/2015/dsa-3238 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html - http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html
CVE ID: CVE-2015-3335 State: PUBLISHED Published: 2015-04-19T10:00:00 Last Updated: 2024-08-06T05:47:57.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72715 - http:
sandbox. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72715 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html - http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html - https://code.google.com/p/chromium/issues/detail?id=455839
CVE ID: CVE-2015-3336 State: PUBLISHED Published: 2015-04-19T10:00:00 Last Updated: 2024-08-06T05:47:57.745Z Vendors: n/a Products: n/a Problem Types: n/a Description: Google Chrome before 42.0.2311.90 does not always ask the user before proceeding with CONTENT_SETTINGS_TYPE_FULLSCREEN and CONTENT_SETTINGS_TYPE_MOUSELOCK changes, which allows user-assisted remote attackers to cause a denial of service (UI disruption) by constructing a crafted HTML document containing JavaScript code with requestFullScreen and requestPointerLock calls, and arranging for the user to access this document with a file: URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/sec
is document with a file: URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2015/dsa-3238 - http://www.securityfocus.com/bid/74227 - http://lists.opensuse.org/opensuse-updates/2015-04/msg00040.html - http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html - https://code.google.com/p/chromium/issues/detail?id=455953
CVE ID: CVE-2015-3337 State: PUBLISHED Published: 2015-05-01T15:00:00 Last Updated: 2024-08-06T05:47:57.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/74353 - http://packetstormsecurity.com/files/131646/Elasticsearch-Directory-Traversal.html - http://www.securityfocus.com/archive/1/535385 - https://www.exploit-db.com/exploits/37054/ - https://www.elastic.co/community/security - http://www.d
archive/1/535385 - https://www.exploit-db.com/exploits/37054/ - https://www.elastic.co/community/security - http://www.debian.org/security/2015/dsa-3241
CVE ID: CVE-2015-3339 State: PUBLISHED Published: 2015-05-27T10:00:00 Last Updated: 2024-08-06T05:47:57.218Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in the prepare_binprm function in fs/exec.c in the Linux kernel before 3.19.6 allows local users to gain privileges by executing a setuid program at a time instant when a chown to root is in progress, and the ownership is changed but the setuid bit is not yet stripped. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html - http://www.securitytracker.com/id/1032412 - http://lists.opensuse.org/opensuse-security-announce/2015-09/
sg00011.html - http://www.securitytracker.com/id/1032412 - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html - https://bugzilla.redhat.com/show_bug.cgi?id=1214030 - http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html - http://www.debian.org/security/2015/dsa-3237 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.opensuse.org/opensuse-security-announce
com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html - http://www.openwall.com/lists/oss-security/2015/04/20/5 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.6 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8b01fc86b9f425899f8a3a8fc1c47d73c2c20543 - http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html - http://rhn.redhat.com/errata/RHSA-2015-1272.html - http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html - https://github.com/torvalds/linux/commit/8b01fc86b9f425899f8a3a8fc1c47d73c2c20543
CVE ID: CVE-2015-3340 State: PUBLISHED Published: 2015-04-28T14:00:00 Last Updated: 2024-08-06T05:47:57.338Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xen 4.2.x through 4.5.x does not initialize certain fields, which allows certain remote service domains to obtain sensitive information from memory via a (1) XEN_DOMCTL_gettscinfo or (2) XEN_SYSCTL_getdomaininfolist request. Additional Analyst Notes: - CVE Program Container: References: - http://xenbits.xen.org/xsa/advisory-132.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156005.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html - http://www.securityfocus.com/bid/74
.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00018.html - http://www.securityfocus.com/bid/74248 - http://www.securitytracker.com/id/1032158 - http://www.debian.org/security/2015/dsa-3414 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157006.html - http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00019.html - https://security.gentoo.org/glsa/201604-03 - http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156979.html - http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00001.html
CVE ID: CVE-2015-3342 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open redirect vulnerability in the Ubercart Currency Conversion module before 6.x-1.2 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination query parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72365 - https://www.drupal.org/node/2407145 - https://www.drupal.org/node/2407347 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3343 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the OPAC module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims for requests that remove a mapping via unknown vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72630 - https://www.drupal.org/node/2403313 - https://www.drupal.org/node/2402393 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3344 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.747Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Course module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2403305 - http://www.securityfocus.com/bid/72631 - http://www.openwall.com/lists/oss-security/2015/01/29/6 - https://www.drupal.org/node/2403333 - https://www.drupal.org/node/2403309
CVE ID: CVE-2015-3345 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the PHPlist Integration Module before 6.x-1.7 for Drupal allows remote administrators to execute arbitrary SQL commands via unspecified vectors, related to the "phpList database." Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2402517 - https://www.drupal.org/node/2403343 - http://www.securityfocus.com/bid/72634 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3346 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.319Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the WikiWiki module before 6.x-1.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2403375 - http://www.securityfocus.com/bid/71503 - https://www.drupal.org/node/2402905 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3347 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:56.946Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote attackers to hijack the authentication of unspecified victims via an unknown menu callback. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2402643 - http://www.securityfocus.com/bid/71926 - https://www.drupal.org/node/2403447 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3348 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Cloudwords for Multilingual Drupal module before 7.x-2.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a node title. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2402643 - http://www.securityfocus.com/bid/71926 - https://www.drupal.org/node/2403447 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3349 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Htaccess module before 7.x-2.3 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) deploy or (2) delete an .htaccess file via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2402825 - http://www.securityfocus.com/bid/71928 - http://www.openwall.com/lists/oss-security/2015/01/29/6 - https://www.drupal.org/node/2403445
CVE ID: CVE-2015-3350 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.278Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Todo Filter module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that toggle a task via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2403013 - https://www.drupal.org/node/2403465 - https://www.drupal.org/node/2403015 - http://www.securityfocus.com/bid/71955 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3351 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Log Watcher module before 6.x-1.2 for Drupal allow remote attackers to hijack the authentication of administrators for requests that (1) enable, (2) disable, or (3) delete a report via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2403463 - http://www.securityfocus.com/bid/71957 - https://www.drupal.org/node/2402767 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3352 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Jammer module before 6.x-1.8 and 7.x-1.x before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of administrators for requests that delete a setting for (1) hidden form elements or (2) status messages via unspecified vectors, related to "report administration." Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2403487 - http://www.securityfocus.com/bid/71958 - https://www.drupal.org/node/2402745 -
: - https://www.drupal.org/node/2403487 - http://www.securityfocus.com/bid/71958 - https://www.drupal.org/node/2402745 - http://www.openwall.com/lists/oss-security/2015/01/29/6 - https://www.drupal.org/node/2402749
CVE ID: CVE-2015-3353 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.501Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Field Display Label module before 7.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via the alternate field label in content types settings. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2403489 - http://www.securityfocus.com/bid/71962 - https://www.drupal.org/node/2403057 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3354 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote attackers to hijack the authentication of arbitrary users for requests that delete wishlist purchase intentions via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2406803 - https://www.drupal.org/node/2406811 - https://www.drupal.org/node/2407313 - http://www.securityfocus.com/bid/72114 - http://www.openwall.com/lists/oss-sec
1 - https://www.drupal.org/node/2407313 - http://www.securityfocus.com/bid/72114 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3355 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.782Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Batch Jobs module before 7.x-1.2 for Drupal allow remote attackers to hijack the authentication of certain users for requests that (1) delete a batch job record or (2) execute a task via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72114 - https://www.drupal.org/node/2403451 - https://www.drupal.org/node/2402839 - http://www.openwall.com/lists/oss-security/2015/01/29/6 - http://www.securit
451 - https://www.drupal.org/node/2402839 - http://www.openwall.com/lists/oss-security/2015/01/29/6 - http://www.securityfocus.com/bid/71954
CVE ID: CVE-2015-3356 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to hijack the authentication of arbitrary users for requests that (1) enable or (2) disable modules or (3) change variables via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72110 - https://www.drupal.org/node/2407321 - https://www.drupal.org/node/2406949 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3357 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Wishlist module before 6.x-2.7 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "access wishlists" permission to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log message. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2406803 - https://www.drupal.org/node/2406811 - https://www.drupal.org/node/2407313 - http://www.openwall.com/lists/oss-security/2015/01
//www.drupal.org/node/2406811 - https://www.drupal.org/node/2407313 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3358 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that (1) enable and disable modules or (2) change variables. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72110 - https://www.drupal.org/node/2407321 - https://www.drupal.org/node/2406949 - http://www.openwall.com/lists/oss-security/2015/01/
/www.drupal.org/node/2407321 - https://www.drupal.org/node/2406949 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3359 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.190Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Room Reservations module before 7.x-1.1 for Drupal allow remote authenticated users with the "Administer the room reservations system" permission to inject arbitrary web script or HTML via the (1) node title of a "Room Reservations Category" or (2) body of a "Room Reservations Room" node. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2406827 - https://www.drupal.org/node/2407329 - http://www.securityfocus.com/bid/72112 - h
- https://www.drupal.org/node/2406827 - https://www.drupal.org/node/2407329 - http://www.securityfocus.com/bid/72112 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3360 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.355Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Term Merge module before 7.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72113 - https://www.drupal.org/node/2407315 - https://www.drupal.org/node/2406869 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3361 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Linkit module before 7.x-2.7 and 7.x-3.x before 7.x-3.3 for Drupal, when the node search plugin is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a node title. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2402855 - https://www.drupal.org/node/2402859 - https://www.drupal.org/node/2403459 - http://www.securityfocus.com/bid/71959 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3362 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Video module before 7.x-2.11 for Drupal, when using the video WYSIWYG plugin, allows remote authenticated users to inject arbitrary web script or HTML via a node title. Additional Analyst Notes: - CVE Program Container: References: - https://www.drupal.org/node/2407047 - https://www.drupal.org/node/2407341 - http://www.openwall.com/lists/oss-security/2015/01/29/6 - http://www.securityfocus.com/bid/72117
CVE ID: CVE-2015-3363 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.345Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in the Contact Form Fields module before 6.x-2.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that delete fields via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72118 - https://www.drupal.org/node/2407147 - https://www.drupal.org/node/2407357 - http://www.openwall.com/lists/oss-security/2015/01/29/6
CVE ID: CVE-2015-3364 State: PUBLISHED Published: 2015-04-21T16:00:00 Last Updated: 2024-08-06T05:47:57.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Content Analysis module before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log message. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/72119 - https://www.drupal.org/node/2407261 - https://www.drupal.org/node/2407395 - http://www.openwall.com/lists/oss-security/2015/01/29/6