Drupal Core Multiple Vulnerabilities (SA-CORE-2017-003) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal Core Multiple Vulnerabilities (SA-CORE-2017-003) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

PECL YAML parser unsafe object handling

More info at https://www.drupal.org/SA-CORE-2017-003...

PECL YAML parser unsafe object handling

More info at https://www.drupal.org/SA-CORE-2017-003...

File REST resource does not properly validate

More info at https://www.drupal.org/SA-CORE-2017-003...

drupal -- Drupal Core - Multiple Vulnerabilities

Drupal Security Team Reports: CVE-2017-6920: PECL YAML parser unsafe object handling. CVE-2017-6921: File REST resource does not properly validate CVE-2017-6922: Files uploaded by anonymous users into a private file system can be accessed by other anonymous users...

VulnCheck KEV: CVE-2017-6922

In Drupal core 8.x prior to 8.3.4 and Drupal core 7.x prior to 7.56; Private files that have been uploaded by an anonymous user but not permanently attached to content on the site should only be visible to the anonymous user that uploaded them, rather than all anonymous users. Drupal core did not...

Drupal Releases Security Updates

Drupal has released an advisory to address several vulnerabilities in Drupal versions 7.x and 8.x. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review Drupal's Security Advisory and upgrade to...

Search 404 - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-053

The Search 404 module enables you to redirect 404 pages to a search page on the site for the keywords in the url that was not found. The module did not filter administrator-provided text before displaying it to the user on the 404 page creating a Cross Site Scripting XSS vulnerability. This...

Drupal Public Download Count Module Open Redirect Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An open redirect vulnerability exists in the Drupal Public Download Count module. Allow attackers to exploit the vulnerability to allow users to access malicious websites,...

LDAP - Critical - Data Injection - SA-CONTRIB-2017-052

The LDAP module does not sanitize user input correctly in several cases, allowing a user to modify parameters without restriction and inject data. If the site administrator chooses to hide the email or password from the user form instead of showing or disabling it under "Authorization", these...

Access Bypass

drupal core is vulenrable to access bypass. If a website is running RESTful Web Services and allows PATCH requests, an authenticated user can bypass access restrictions...

Drupal Shibboleth authentication module access bypass vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Shibboleth Authentication is one of the user login and get access to the authentication module . An access bypass vulnerability exists in the Drupal Shibboleth authentication module...

Drupal Bootstrap Module Information Disclosure Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in the Drupal Bootstrap module. An attacker can exploit this vulnerability to obtain sensitive information leading to furthe...

Custom Landing Page Builder - Unsupported - SA-CONTRIB-2017-050

The Custom Landing Page Builder module allows webmasters to build custom landing pages using a WYSIWYG editor while still having full control over the full layout of the page including the header, navigation, page content, footer, forms etc. The security team is marking this module unsupported...

Drupal Display Suite module cross-site scripting vulnerability (CNVD-2017-10592)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Display Suite module, which stems from the program not properly validating user input. When an unknowing user...

Site Verify - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-051

The Site Verify module enables privilege users to verify a site with services like Google Webmaster Tools using meta tags or file uploads. The module doesn't sufficiently sanitize input or restrict uploads. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Drupal Linkit Module Access Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP. An access bypass vulnerability exists in the Drupal Linkit module. An attacker can exploit this vulnerability to perform unauthorized operations bypassing some security restrictions...

Display Suite - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2017-049

Display Suite allows you to take full control over how your content is displayed using a drag and drop interface. In certain situations, Display Suite does not properly sanitize some of the output, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting XSS...

Bootstrap - Critical - Information Disclosure - SA-CONTRIB-2017-048

This theme enables you to bridge the gap between the Bootstrap Framework and Drupal. The theme does not sufficiently exclude the submitted password value when an incorrect value has been submitted Versions affected bootstrap 8.x-3.x versions prior to 8.x-3.5. Drupal core is not affected. If you d...