drupal -- multiple vulnerabilities

2016-02-24T00:00:00
ID 59A0AF97-DBD4-11E5-8FA8-14DAE9D210B8
Type freebsd
Reporter FreeBSD
Modified 2016-02-24T00:00:00

Description

Drupal Security Team reports:

File upload access bypass and denial of service (File module - Drupal 7 and 8 - Moderately Critical) Brute force amplification attacks via XML-RPC (XML-RPC server - Drupal 6 and 7 - Moderately Critical) Open redirect via path manipulation (Base system - Drupal 6, 7 and 8 - Moderately Critical) Form API ignores access restrictions on submit buttons (Form API - Drupal 6 - Critical) HTTP header injection using line breaks (Base system - Drupal 6 - Moderately Critical) Open redirect via double-encoded 'destination' parameter (Base system - Drupal 6 - Moderately Critical) Reflected file download vulnerability (System module - Drupal 6 and 7 - Moderately Critical) Saving user accounts can sometimes grant the user all roles (User module - Drupal 6 and 7 - Less Critical) Email address can be matched to an account (User module - Drupal 7 and 8 - Less Critical) Session data truncation can lead to unserialization of user provided data (Base system - Drupal 6 - Less Critical)