Pere Orga

The issue might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information.

The issue allows remote authenticated users to gain privileges through certain vectors involving contributed or custom code that triggers a rebuild of the user profile form.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a double-encoded URL in the `destination` parameter of the drupal goto function, specifically when used with PHP before 5.4.7.

A CRLF injection issue exists in the drupal set header function when used with PHP before 5.1.2, allowing remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.

The issue might allow remote attackers to execute arbitrary code via vectors related to session data truncation when used with certain PHP versions.

The issue allows remote authenticated users to bypass access restrictions. This can lead to reading, deleting, or substituting a link to a file uploaded to an unprocessed form. The exploitation is possible by leveraging permission to create content or comment and upload files.

The issue allows remote attackers to conduct open redirect attacks by leveraging custom code or a form shown on a 404 error page, related to path manipulation.

The XML-RPC system might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.

The issue might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is due to an incomplete fix for a previous issue.

A cross-site scripting (XSS) issue in the Autocomplete system allows remote attackers to inject arbitrary web script or HTML via a crafted URL, related to uploading files.

The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified parameters.

A cross-site scripting (XSS) issue exists, allowing remote authenticated users with permission to create or edit fields to inject arbitrary web script or HTML.

The issue allows remote attackers to execute arbitrary SQL commands.

The issue allows remote attackers to execute arbitrary PHP code via a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site environment.

A cross-site scripting (XSS) issue exists in the Navigate module, allowing remote authenticated users with specific permissions to inject arbitrary web script or HTML.

The issue allows remote attackers to have an unspecified impact via unknown vectors due to improper access restriction to Storage API fields attached to non-node entities.

A cross-site request forgery (CSRF) issue exists in the XC NCIP Provider module, allowing remote attackers to hijack the authentication of users with the `administer ncip providers` permission. This can occur through crafted requests that alter NCIP providers.

A cross-site scripting (XSS) issue exists, allowing remote authenticated users with the `administer menu` permission to inject arbitrary web script or HTML.

A cross-site scripting (XSS) issue in the Video Consultation module allows remote attackers to inject arbitrary web script or HTML.