Vulnerabilities

TI-2014-07597 CVE-2014-9364 · GHSA-8w3g-82f7-whvf

Cross-site scripting (XSS) vulnerability in the Unified Login form in the LoginToboggan…

LOW 22

Cross-site scripting (XSS) vulnerability in the Unified Login form in the LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00931 Published 2014-12-10 No fix listed CWE-79

TI-2014-07594 CVE-2014-9361 · GHSA-6r66-qq57-7c7w

The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the…

LOW 22

The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the authorized user role for certain users, which allows remote attackers with the pre-authorized role to gain privileges and possibly ob…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01066 Published 2014-12-10 No fix listed CWE-200

Vulnerabilities

Filters

Cross-site scripting (XSS) vulnerability in the Unified Login form in the LoginToboggan…

The LoginToboggan module 7.x-1.x before 7.x-1.4 for Drupal does not properly unset the…