14613 matches found
Private file access bypass.
More info at https://www.drupal.org/SA-CORE-2018-001...
Settings Tray access bypass.
More info at https://www.drupal.org/SA-CORE-2018-001...
Settings Tray access bypass.
More info at https://www.drupal.org/SA-CORE-2018-001...
External link injection on 404 pages when linking to the current page.
More info at https://www.drupal.org/SA-CORE-2018-001...
Language fallback can be incorrect on multilingual sites with node access restrictions.
More info at https://www.drupal.org/SA-CORE-2018-001...
jQuery vulnerability with untrusted domains.
More info at https://www.drupal.org/SA-CORE-2018-001...
JavaScript cross-site scripting prevention is incomplete.
More info at https://www.drupal.org/SA-CORE-2018-001...
External link injection on 404 pages when linking to the current page.
More info at https://www.drupal.org/SA-CORE-2018-001...
Comment reply form allows access to restricted content.
More info at https://www.drupal.org/SA-CORE-2018-001...
Entity Backup - Critical - Module Unsupported - SA-CONTRIB-2018-012
The main purpose of the Entity Backup module is to keep a backup of deleted Drupal core entities and perform recovery of them. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to...
Entity API - Moderately critical - Information Disclosure - SA-CONTRIB-2018-013
The Entity API module extends the entity API of Drupal core in order to provide a unified way to deal with entities and their properties. The module prints debugging information to the HTML output in certain error conditions thereby causing an information disclosure vulnerability. This...
DRUPAL-CONTRIB-2018-008
This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...
Drupal Open Atrium Module Cross-Site Request Forgery Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform. Multiple cross-site request forgery vulnerabilities exist in subcomponents of the Drupal Open...
Drupal Open Atrium module Discussions sub module security vulnerability
Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform.Discussions sub module is one of the sub-modules. A security vulnerability exists in the...
Drupal Open Atrium Module OG Subgroups Module Access Bypass Vulnerability
Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a teamwork development module based on the Drupal platform.OG Subgroups module is one of the OG subgroups module. A security vulnerability exists in the OG...
CVE-2014-9504
The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance...
Design/Logic Flaw
The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance...
CVE-2014-9503
The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote attackers to hijack the authentication of unknown victims via vectors related to menu callbacks...
Improper access control
The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks...