CVE-2014-4303
18.06.2014, 14:55
Multiple cross-site scripting (XSS) vulnerabilities in the Touch theme 7.x-1.x before 7.x-1.9 for Drupal allow remote authenticated users with the Administer themes permission to inject arbitrary web script or HTML via vectors related to the (1) Twitter and (2) Facebook username settings.
| Vendor | Product | Version |
|---|---|---|
| drupac | touch | 7.x-1.0:x |
| drupac | touch | 7.x-1.1:x |
| drupac | touch | 7.x-1.2:x |
| drupac | touch | 7.x-1.3:x |
| drupac | touch | 7.x-1.4:x |
| drupac | touch | 7.x-1.5:x |
| drupac | touch | 7.x-1.6:x |
| drupac | touch | 7.x-1.7:x |
| drupac | touch | 7.x-1.8:x |
𝑥
= Vulnerable software versions