14614 matches found
Unpublished 404 - Critical - Access bypass - SA-CONTRIB-2017-021
The purpose of Unpublished 404 module is to emit a 404 error when a user tries to access a unpublished pages. Unpublished 404 7.x-1.0 has an access bypass vulnerability. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team...
DownloadFile - Critical - Unsupported - SA-CONTRIB-2017-023
DownloadFile is a module to direct download files or images. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466...
Microblog - Critical - Unsupported - SA-CONTRIB-2017-007
This module enables microblogging on Drupal sites using it. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes. Versions affected All versions Drupal core is not affected. If you do not use the contributed microblog...
SalesCloud - Critical - Unsupported - SA-CONTRIB-2017-008
This module Connects Drupal to SalesCloud's API, a Commerce Platform as a Service. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes. Versions affected All versions Drupal core is not affected. If you do not use th...
Drupal OpenLucius Module Cross-Site Scripting Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.OpenLucius is one of the work management platforms for social communication, documentation and projects. A cross-site scripting vulnerability exists in the Drupal OpenLucius module. An...
Drupal Autocomplete Deluxe Module Cross-Site Scripting Vulnerability
Drupal is the Drupal community maintained by a set of free , open source content management system developed in PHP language . Autocomplete Deluxe is one of the modules based on the JQuery UI autocomplete for the classification field to create a new widget . A cross-site scripting vulnerability...
Mailjet - Highly critical - Arbitrary PHP code execution - SA-CONTRIB-2017-005
The Mailjet module integrates with a 3rd party system to deliver site-generated emails, including newsletters, system notifications, etc. The Mailjet module included v5.2.8 of the PHPMailer library in its "includes" directory. Per PSA-2016-004, this version of the PHPMailer library was vulnerable...
OpenLucius - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-004
OpenLucius is a work management platform for social communication, documentation, and projects. The distribution doesn't sufficiently use tokens when marking messages for users as read thereby exposing a Cross Site Request Forgery CSRF vulnerability. The distribution does not sufficiently filter...
Autocomplete Deluxe - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-003
This module creates a new widget for taxonomy fields based on JQuery UI autocomplete. The module doesn't sufficiently escape the entered taxonomy terms thereby exposing a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have the permission ...
Multiple Vulnerabilities in Drupal Permissions by Term
The Permissions by Term module is a module from Drupal. The module provides both front-end and back-end functionality. No programming skills are required, and the module can be handled by the Drupal site builder through a user interface in a web browser. Permissions by Term module version 8.x-1.1...
Multiple Cross-Site Scripting Vulnerabilities in Drupal Doubleclick for Publishers Module
Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. Multiple cross-site scripting vulnerabilities exist in the Drupal Doubleclick for Publishers module. The vulnerabilities can be exploited to execute arbitrary script code ...
Permissions by Term -- Critical - Multiple vulnerabilities - SA-CONTRIB-2017-001
The Permissions by Term module extends Drupal functionality by restricting access to single nodes via taxonomy terms. Taxonomy terms are part of the Drupal core functionality. Taxonomy term permissions can be coupled to specific user accounts and/or user roles. Enabling the module unintentionally...
Doubleclick for Publishers (DFP) - Moderately Critical - Multiple vulnerabilities - SA-CONTRIB-2017-002
This module enables you to to place advertisements on your site that are served by Google's DFP Doubleclick for Publisher service. The module has multiple Cross Site Scripting XSS vulnerabilities due to not sufficiently escaped fields. The "administer DFP" permission is not marked as restricted...
PHPMailer Bug Leaves Millions of Websites Open to Attack
UPDATE A critical PHPMailer bug tied to the way websites handle email and feedback forms is leaving millions of websites hosted on popular web-publishing platforms such as WordPress, Drupal and Joomla open to attack. The flaw was disclosed by researcher Dawid Golunski of Legal Hackers, who said t...
Unspecified Security Bypass Vulnerability in Drupal JavaScript Callback Handler
Drupal is the Drupal community maintained by a set of free , open source content management system developed in PHP language . JavaScript Callback Handler is an efficient Ajax Callback module . An unspecified security bypass vulnerability exists in the Drupal JavaScript Callback Handler module. A...
Updated drupal packages fix security vulnerability
Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users CVE-2016-9449. Confirmation forms allow external URLs to be injected CVE-2016-9451...
MGASA-2016-0413 Updated drupal packages fix security vulnerability
Inconsistent name for term access query; information on taxonomy terms might have been disclosed to unprivileged users CVE-2016-9449. Confirmation forms allow external URLs to be injected CVE-2016-9451...
High-performance JavaScript callback handler - Highly Critical - Multiple vulnerabilities - SA-CONTRIB-2016-063
The High-performance JavaScript callback handler module is a light weight callback to bypass most, if not all, of Drupal's bootstrapping process to achieve improved performance. The module does not sufficiently check whether or not a callback is being properly accessed or filtering for potential...
Drupal Elysia Cron Module Arbitrary PHP Code Execution Vulnerability
Drupal is a free, open source content management system developed in PHP language maintained by the Drupal community, and Elysia Cron is one of the cron job management modules. An arbitrary PHP code execution vulnerability exists in the Drupal Elysia Cron module. An attacker can exploit the...
