Forest Monsen

Name of the Vulnerable Software and Affected Versions: Organic Groups (OG) module versions 7.x-2.x before 7.x-2.3 for Drupal Description: The issue allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors, due to the improper restriction of access to private groups. Recommendations: For Organic Groups (OG) module versions 7.x-2.x before 7.x-2.3, update to version 7.x-2.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mozilla Persona module versions 7.x-1.x through 7.x-1.10 Description: A cross-site request forgery (CSRF) issue exists in the `persona xsrf token` function within the persona.module of the Mozilla Persona module for Drupal. This allows remote attackers to hijack the authentication of arbitrary users via a security token that is not a string data type. Recommendations: For Mozilla Persona module versions 7.x-1.x through 7.x-1.10, update to version 7.x-1.11 or later to resolve the issue. As a temporary workaround, consider disabling the `persona xsrf token` function until a patch is available. Restrict access to the persona.module to minimize the risk of exploitation. Avoid using the security token in a non-string data type in the affected module until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Drupal Authenticated User Page Caching (Authcache) module versions 7.x-1.x before 7.x-1.5 Description: The issue allows remote attackers with the same role-combination as the superuser to obtain sensitive information via the cached pages of the superuser, due to improper access restriction to cached pages. Recommendations: For Drupal Authenticated User Page Caching (Authcache) module versions 7.x-1.x before 7.x-1.5, update to version 7.x-1.5 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Commerce Skrill (Formerly Moneybookers) versions prior to 7.x-1.2 Description: The issue is an Access bypass vulnerability. Recommendations: For versions prior to 7.x-1.2, update to version 7.x-1.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Login Security module versions 6.x-1.x before 6.x-1.3 Login Security module versions 7.x-1.x before 7.x-1.3 Description: The issue allows attackers to bypass intended restrictions via a crafted `username`. Recommendations: For versions 6.x-1.x before 6.x-1.3, update to version 6.x-1.3 or later. For versions 7.x-1.x before 7.x-1.3, update to version 7.x-1.3 or later.

Name of the Vulnerable Software and Affected Versions: Smiley module versions prior to 6.x-1.1 Smileys module versions prior to 6.x-1.1 Description: A cross-site scripting (XSS) issue allows remote authenticated users with the `administer smiley` permission to inject arbitrary web script or HTML via a smiley acronym. Recommendations: For Smiley module versions prior to 6.x-1.1, update to version 6.x-1.1 or later. For Smileys module versions prior to 6.x-1.1, update to version 6.x-1.1 or later. As a temporary workaround, consider restricting the `administer smiley` permission to minimize the risk of exploitation.

The issue allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment, due to the lack of access restriction by anonymous users.

The issue allows remote authenticated users to read node comments via unspecified vectors due to improper access restriction.

The issue allows remote attackers to cause a denial of service, specifically process consumption, via multiple requests when the `delay misery` configuration is set to a high value.

The issue allows remote authenticated users to obtain sensitive information due to improper checking of node access permissions for unpublished content.

A cross-site scripting (XSS) issue exists in the MediaFront module for Drupal, allowing remote authenticated users with the "administer mediafront" permission to inject arbitrary web script or HTML via the preset settings.

The issue allows remote attackers to obtain sensitive information by reading a Quick Tab, due to improper checking of block permissions.

The issue affects the Spaces OG submodule in the Spaces module for Drupal. It does not properly delete organic group group spaces content when the option to move to a new group is used, resulting in "orphaned" content. This allows remote authenticated users with the "access content" permission to obtain sensitive information via vectors involving a rebuild access for the site or content.

The issue allows remote authenticated users with the `view any quiz results` or `view results for own quiz` permission to delete arbitrary results.

The issue allows remote attackers to read arbitrary node comments via a crafted URL.

The issue allows remote attackers to obtain sensitive information due to improper permission checking.

The issue allows remote authenticated users to bypass group restrictions on nodes with all groups set to optional input via an empty group field.

A cross-site scripting (XSS) issue exists, allowing remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values.

The issue allows remote attackers to cause a denial of service via a GET request with an HTTP Accept header set to a non-HTML type. This can interfere with Drupal's page cache when page caching is enabled and anonymous users are assigned RESTWS permissions.

The issue allows remote attackers to bypass intended access restrictions for a poll by making a direct request to the node's URL instead of the hashed URL.