14614 matches found
Media - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-044
This module provides intuitive ways to manage large libraries of media, insert or display or import various types of media either through fields or a wysiwyg interface. Versions of this module prior to 7.x-2.1 or 7.x-3.0-alpha5 did not sufficiently whitelist input parameters for the media browser...
Webform Multiple file upload - Moderately Critical - Access bypass - SA-CONTRIB-2017-045
This module enables you to upload multiple files at once in a webform. The module doesn't sufficiently check access to file deletion urls. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit all or their own webform submissions. CVE identifier...
DRD Agent - Critical - Multiple vulnerabilities - SA-CONTRIB-2017-047
The Drupal Remote Dashboard DRD module enables you to manage and monitor any remote Drupal site and, this module, the DRD Agent is the remote module which responds to requests from authorised DRD sites. The module doesn't sufficiently protect the URL used to configure itself from CSRF attacks,...
Drupal Remote Dashboard - Critical - Weak encryption keys - SA-CONTRIB-2017-046
UPDATE 2017-07-12 : This SA originally only mentioned the Drupal 8 version of the module, but it was later discovered that this issue affected the Drupal 7 version as well. We've updated the SA for the Drupal 7 security release. Sorry for the confusion! This module enables you to remotely access...
shib_auth Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-043
This module enables you to login via Shibboleth. The module doesn't sufficiently logout the user when the shib session expires, which depending on the caching mechanism makes private data public. This vulnerability is mitigated by the fact that shibauth would have to be used in combination with a...
[SECURITY] Fedora 25 Update: drupal8-8.3.1-1.fc25
Drupal is an open source content management platform powering millions of websites and applications. Its built, used, and supported by an active and diverse community of people around the world...
[SECURITY] Fedora 24 Update: drupal8-8.3.1-1.fc24
Drupal is an open source content management platform powering millions of websites and applications. Its built, used, and supported by an active and diverse community of people around the world...
[SECURITY] Fedora 26 Update: drupal8-8.3.1-1.fc26
Drupal is an open source content management platform powering millions of websites and applications. Its built, used, and supported by an active and diverse community of people around the world...
Drupal 8.x < 8.2.8 / 8.3.x < 8.3.1 Access Bypass Vulnerability (SA-CORE-2017-002)
According to its self-reported version, the instance of Drupal running on the remote web server is 8.x prior to 8.2.8 or 8.3.x prior to 8.3.1. It is, therefore, affected by an access bypass vulnerability due to an unspecified flaw when the RESTful Web Services rest module is enabled and the site...
Drupal Core Privilege Bypass Vulnerability
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A privilege bypass vulnerability exists in Drupal Core version 8 before 8.2.8 and version 8.3 before 8.3.1. If the RESTful Web Services rest module is enabled, the site...
Drupal Core - Access Bypass vulnerability (CVE-2017-6919)
This is a critical access bypass vulnerability. A site is only affected by this if all of the following conditions are met: The site has the RESTful Web Services rest module enabled. The site allows PATCH requests. An attacker can get or register a user account on the site. While we don't normall...
Drupal Closes Access Bypass Vulnerability in Core Engine
A critical vulnerability in the Drupal Core engine was addressed in an update released Wednesday. Drupal engineers are calling it an access bypass vulnerability and said a Drupal-based website is vulnerable only under certain conditions, including whether a site has the RESTful Web Services modul...
CVE-2017-6919
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...
CVE-2017-6919
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...
Design/Logic Flaw
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...
CVE-2017-6919
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...
CVE-2017-6919
Drupal 8 before 8.2.8 and 8.3 before 8.3.1 allows critical access bypass by authenticated users if the RESTful Web Services rest module is enabled and the site allows PATCH requests...
CVE-2017-6919
CVE-2017-6919 affects Drupal 8 where, if RESTful Web Services (rest) is enabled and PATCH requests are allowed, an authenticated user can bypass access controls. Affected versions are Drupal 8 up to 8.2.8 and 8.3 up to 8.3.1. The underlying issue is a critical access bypass in the REST module, en...
Drupal Core Access Bypass Vulnerability (SA-CORE-2017-002)
Drupal is prone to an access bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...
