Forest Monsen

Name of the Vulnerable Software and Affected Versions: Organic Groups (OG) module versions 7.x-2.x before 7.x-2.3 for Drupal Description: The issue allows remote authenticated users to guess node IDs, subscribe to, and read the content of arbitrary private groups via unspecified vectors, due to the improper restriction of access to private groups. Recommendations: For Organic Groups (OG) module versions 7.x-2.x before 7.x-2.3, update to version 7.x-2.3 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Mozilla Persona module versions 7.x-1.x through 7.x-1.10 Description: A cross-site request forgery (CSRF) issue exists in the `persona xsrf token` function within the persona.module of the Mozilla Persona module for Drupal. This allows remote attackers to hijack the authentication of arbitrary users via a security token that is not a string data type. Recommendations: For Mozilla Persona module versions 7.x-1.x through 7.x-1.10, update to version 7.x-1.11 or later to resolve the issue. As a temporary workaround, consider disabling the `persona xsrf token` function until a patch is available. Restrict access to the persona.module to minimize the risk of exploitation. Avoid using the security token in a non-string data type in the affected module until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: Drupal Authenticated User Page Caching (Authcache) module versions 7.x-1.x before 7.x-1.5 Description: The issue allows remote attackers with the same role-combination as the superuser to obtain sensitive information via the cached pages of the superuser, due to improper access restriction to cached pages. Recommendations: For Drupal Authenticated User Page Caching (Authcache) module versions 7.x-1.x before 7.x-1.5, update to version 7.x-1.5 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Commerce Skrill (Formerly Moneybookers) versions prior to 7.x-1.2 Description: The issue is an Access bypass vulnerability. Recommendations: For versions prior to 7.x-1.2, update to version 7.x-1.2 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Login Security module versions 6.x-1.x before 6.x-1.3 Login Security module versions 7.x-1.x before 7.x-1.3 Description: The issue allows attackers to bypass intended restrictions via a crafted `username`. Recommendations: For versions 6.x-1.x before 6.x-1.3, update to version 6.x-1.3 or later. For versions 7.x-1.x before 7.x-1.3, update to version 7.x-1.3 or later.

Name of the Vulnerable Software and Affected Versions: Smiley module versions prior to 6.x-1.1 Smileys module versions prior to 6.x-1.1 Description: A cross-site scripting (XSS) issue allows remote authenticated users with the `administer smiley` permission to inject arbitrary web script or HTML via a smiley acronym. Recommendations: For Smiley module versions prior to 6.x-1.1, update to version 6.x-1.1 or later. For Smileys module versions prior to 6.x-1.1, update to version 6.x-1.1 or later. As a temporary workaround, consider restricting the `administer smiley` permission to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Payment for Webform module versions 7.x-1.x before 7.x-1.5 **Description** The issue allows remote anonymous users to use the payment of other anonymous users when submitting a form that requires payment, due to the lack of access restriction by anonymous users. **Recommendations** For Payment for Webform module versions 7.x-1.x before 7.x-1.5, update to version 7.x-1.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Entity API module versions 7.x-1.x through 7.x-1.1 **Description** The issue allows remote authenticated users to read node comments via unspecified vectors due to improper access restriction. **Recommendations** For Entity API module versions 7.x-1.x through 7.x-1.1, update to version 7.x-1.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal Misery module versions 6.x-2.x before 6.x-2.5 Drupal Misery module versions 7.x-2.x before 7.x-2.2 **Description** The issue allows remote attackers to cause a denial of service, specifically process consumption, via multiple requests when the `delay misery` configuration is set to a high value. **Recommendations** For Drupal Misery module version 6.x-2.x, update to version 6.x-2.5 or later. For Drupal Misery module version 7.x-2.x, update to version 7.x-2.2 or later. As a temporary workaround, consider setting the `delay misery` configuration to a lower value to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Revisioning module for Drupal versions 7.x-1.x before 7.x-1.6 **Description** The issue allows remote authenticated users to obtain sensitive information due to improper checking of node access permissions for unpublished content. **Recommendations** For Revisioning module for Drupal versions 7.x-1.x before 7.x-1.6, update to version 7.x-1.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MediaFront module versions 6.x-1.x before 6.x-1.6 MediaFront module versions 7.x-1.x before 7.x-1.6 MediaFront module versions 7.x-2.x before 7.x-2.1 **Description** A cross-site scripting (XSS) issue exists in the MediaFront module for Drupal, allowing remote authenticated users with the "administer mediafront" permission to inject arbitrary web script or HTML via the preset settings. **Recommendations** For MediaFront module version 6.x-1.x, update to version 6.x-1.6 or later. For MediaFront module version 7.x-1.x, update to version 7.x-1.6 or later. For MediaFront module version 7.x-2.x, update to version 7.x-2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Quick Tabs module versions 6.x-2.x through 6.x-2.1 Quick Tabs module versions 6.x-3.x through 6.x-3.1 Quick Tabs module versions 7.x-3.x through 7.x-3.5 **Description** The issue allows remote attackers to obtain sensitive information by reading a Quick Tab, due to improper checking of block permissions. **Recommendations** For Quick Tabs module versions 6.x-2.x through 6.x-2.1, update to version 6.x-2.2 or later. For Quick Tabs module versions 6.x-3.x through 6.x-3.1, update to version 6.x-3.2 or later. For Quick Tabs module versions 7.x-3.x through 7.x-3.5, update to version 7.x-3.6 or later.

**Name of the Vulnerable Software and Affected Versions** Drupal Spaces module versions 6.x-3.x before 6.x-3.7 **Description** The issue affects the Spaces OG submodule in the Spaces module for Drupal. It does not properly delete organic group group spaces content when the option to move to a new group is used, resulting in "orphaned" content. This allows remote authenticated users with the "access content" permission to obtain sensitive information via vectors involving a rebuild access for the site or content. **Recommendations** For versions 6.x-3.x before 6.x-3.7, update to version 6.x-3.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Quiz module versions 6.x-4.x before 6.x-4.5 **Description** The issue allows remote authenticated users with the `view any quiz results` or `view results for own quiz` permission to delete arbitrary results. **Recommendations** For versions prior to 6.x-4.5, update to version 6.x-4.5 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Monster Menus module versions 7.x-1.x before 7.x-1.15 **Description** The issue allows remote attackers to read arbitrary node comments via a crafted URL. **Recommendations** For Monster Menus module versions 7.x-1.x before 7.x-1.15, update to version 7.x-1.15 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Invitation module versions 7.x-2.x **Description** The issue allows remote attackers to obtain sensitive information due to improper permission checking. **Recommendations** For Invitation module versions 7.x-2.x, update the module to a version that properly checks permissions, or consider disabling the default views until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Organic Groups (OG) module versions 7.x-2.x through 7.x-2.2 **Description** The issue allows remote authenticated users to bypass group restrictions on nodes with all groups set to optional input via an empty group field. **Recommendations** For Organic Groups (OG) module versions 7.x-2.x through 7.x-2.2, update to version 7.x-2.3 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** EU Cookie Compliance module versions prior to 7.x-1.12 **Description** A cross-site scripting (XSS) issue exists, allowing remote authenticated administrators with the "Administer EU Cookie Compliance popup" permission to inject arbitrary web script or HTML via unspecified configuration values. **Recommendations** For versions prior to 7.x-1.12, update to version 7.x-1.12 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Drupal RESTful Web Services (RESTWS) module versions 7.x-1.x before 7.x-1.3 Drupal RESTful Web Services (RESTWS) module versions 7.x-2.x before 7.x-2.0-alpha5 **Description** The issue allows remote attackers to cause a denial of service via a GET request with an HTTP Accept header set to a non-HTML type. This can interfere with Drupal's page cache when page caching is enabled and anonymous users are assigned RESTWS permissions. **Recommendations** For versions 7.x-1.x before 7.x-1.3, update to version 7.x-1.3 or later. For versions 7.x-2.x before 7.x-2.0-alpha5, update to version 7.x-2.0-alpha5 or later.

**Name of the Vulnerable Software and Affected Versions** Make Meeting Scheduler module versions 6.x-1.x before 6.x-1.3 **Description** The issue allows remote attackers to bypass intended access restrictions for a poll by making a direct request to the node's URL instead of the hashed URL. **Recommendations** For Make Meeting Scheduler module versions 6.x-1.x before 6.x-1.3, update to version 6.x-1.3 or later to resolve the issue.