Joshua Brauer

A cross-site scripting issue exists, allowing remote attackers to inject arbitrary web script or HTML via a user name in a private message.

A cross-site scripting (XSS) issue exists in the Hashcash module for Drupal. This occurs when the "Log failed hashcash" option is enabled, and an invalid token is not properly handled by the Database logging module, allowing remote attackers to inject arbitrary web script or HTML.

The issue concerns the Listhandler module for Drupal, where it fails to properly check permissions when importing emails. This allows remote comment authors to bypass access restrictions, potentially leading to unspecified impacts.

The issue allows remote attackers to disable an autocompletion or change the priority order due to improper access restriction to the module admin page.

The issue allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension followed by a safe extension, then accessing it via a direct request to the directory specified by the `filedir` parameter. This is made possible by an unrestricted file upload vulnerability in the `upload.php` file.

The issue allows remote authenticated users with the `view any node page` or `view any node {type} page` permission to access unpublished nodes via a direct request.

The issue allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, which can lead to cross-site scripting (XSS) attacks.

The issue allows remote attackers to edit an arbitrary user's questions and answers due to improper access restriction in the Security Questions module.

A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML.

The issue allows remote attackers to bypass access restrictions. The attack vectors are unknown.

A cross-site request forgery issue allows remote attackers to hijack the authentication of administrators.

The issue allows remote attackers to execute arbitrary SQL commands.

A cross-site request forgery (CSRF) issue allows remote attackers to hijack the authentication of arbitrary users for requests that switch the user to a subuser.

The issue concerns the Subuser module for Drupal, where it fails to properly check `switch subuser` permissions. This allows remote authenticated parent users to change their role by switching to a subuser they created.

The issue is related to a cross-site scripting (XSS) vulnerability in the administrative interface of the Better Revisions module for Drupal. This vulnerability allows remote authenticated users with the "administer better revisions" permission to inject arbitrary web script or HTML.

The issue is related to a cross-site scripting (XSS) vulnerability in the "3 slide gallery" of the Elegant Theme module. This allows remote authenticated users with the "administer themes" permission to inject arbitrary web script or HTML via a slide URL.

The issue is related to improper access restriction to the "Campaign" content type, which could allow remote attackers to bypass access restrictions and potentially have other unspecified impacts.

A cross-site scripting (XSS) issue exists in the settings page of the Hotblocks module for Drupal, specifically at the 'admin/settings/hotblocks' endpoint. This allows remote authenticated users with the `administer hotblocks` permission to inject arbitrary web script or HTML via the `block names` variable.

The issue allows remote attackers to read node or user results via the location search page due to improper checking of user or node access permissions.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the `q` parameter. This is due to an open redirect vulnerability in the `securelogin secure redirect` function.