Drupal Colorbox Module Access Restriction Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. colorbox is one of the customizable jQuery popup box component modules. A security vulnerability exists in the Drupal Colorbox module 7.x-2.10 prior to version 7.x-2.x. A remote attack...

Field as Block - Less Critical - Information Disclosure - SA-CONTRIB-2015-161

This module enables you to take a field from the current entity and place it elsewhere as a block. The module caches the block output in a manner that could allow sensitive content to be seen by visitors who should not see it. The problem will only occur when other modules alter field output base...

CVE-2015-7881

The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment...

Design/Logic Flaw

The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment...

CVE-2015-7881

The Colorbox module 7.x-2.x before 7.x-2.10 for Drupal allows remote authenticated users with certain permissions to bypass intended access restrictions and "add unexpected content to a Colorbox" via unspecified vectors, possibly related to a link in a comment...

CVE-2015-7881

The Drupal Colorbox module (7.x-2.x, prior to 7.x-2.10) allows remote authenticated users with specific permissions to bypass access restrictions and add unwanted content to a Colorbox, likely via a link-in-comment vector. Affected: Colorbox 7.x-2.x (

[SECURITY] Fedora 22 Update: drupal7-active_tags-2.0-0.9.alpha1.fc22

Active Tags adds a new option to free tagging taxonomies. If selected the taxonomy widget is replaced by a new jQuery enabled tag entry widget. This package provides the following Drupal 7 module: activetags...

[SECURITY] Fedora 21 Update: drupal7-active_tags-2.0-0.9.alpha1.fc21

Active Tags adds a new option to free tagging taxonomies. If selected the taxonomy widget is replaced by a new jQuery enabled tag entry widget. This package provides the following Drupal 7 module: activetags...

FreeBSD : drupal -- open redirect vulnerability (75f39413-7a00-11e5-a2a1-002590263bf5)

Drupal development team reports : The Overlay module in Drupal core displays administrative pages as a layer over the current page using JavaScript, rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents,...

[SECURITY] Fedora 22 Update: drupal7-jquery_update-2.6-1.fc22

Upgrades the version of jQuery in Drupal core to a newer version of jQuery. This package provides the following Drupal module: jqueryupdate...

drupal: open redirect

The Overlay module in Drupal core displays administrative pages as a layer over the current page using JavaScript, rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect...

Joomla 3.4.5 patches Critical SQL Injection Vulnerability

Joomla – one of the most popular open source Content Management System CMS software packages, has reportedly patched three critical vulnerabilities in its software. The flaws, exist in the Joomla version 3.2 to 3.4.4, include SQL injection vulnerabilities that could allow hackers to take admin...

Drupal Arbitrary SQL Command Execution Vulnerability

Drupal is an open source content management platform. Arbitrary SQL command execution vulnerability exists in Drupal 7 driver for SQL Server SQL Azure versions 7.x-1.x prior to 7.x-1.4. Allows remote attackers to execute arbitrary SQL commandsvec execute arbitrary SQL commands...

Sql injection

The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the dblike function...

CVE-2015-7876

The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the dblike function...

CVE-2015-7876

CVE-2015-7876 concerns the Drupal 7 driver for SQL Server and SQL Azure (7.x-1.x prior to 7.x-1.4). The escapeLike function in sqlsrv/database.inc does not properly escape certain characters, enabling a remote attacker to execute arbitrary SQL commands via vectors involving a module using db_like...

CVE-2015-7876

The escapeLike function in sqlsrv/database.inc in the Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x before 7.x-1.4 does not properly escape certain characters, which allows remote attackers to execute arbitrary SQL commands via vectors involving a module using the dblike function...

Webform CiviCRM Integration - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-160

Webform CiviCRM Integration allows you to add CiviCRM fields to a Drupal Webform. The module doesn't sufficiently escape user input. Some of the vulnerabilities are mitigated by the fact that an attacker must have a role with the permission to edit the webform node plus "access CiviCRM" to define...

Drupal Core - Overlay - Less Critical - Open Redirect - SA-CORE-2015-004

The Overlay module in Drupal core displays administrative pages as a layer over the current page using JavaScript, rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect...

drupal -- open redirect vulnerability

Drupal development team reports: The Overlay module in Drupal core displays administrative pages as a layer over the current page using JavaScript, rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents,...