Apigee Edge - Moderately critical - Access bypass - SA-CONTRIB-2023-005

The Apigee Edge module allows connecting a Drupal site to Apigee X / Edge in order to build a developer portal. Previous module versions did not support entity query level access checking, which could have led to information disclosure or access bypass in various places...

Media Library Block - Moderately critical - Information Disclosure - SA-CONTRIB-2023-003

The Media Library Block module allows you to render a media entity in a block. The module does not properly check media access in some circumstances. This may result in unauthorized users including anonymous users seeing media items they are not authorized to access if a block containing a...

Media Library Form API Element - Moderately critical - Information Disclosure - SA-CONTRIB-2023-004

This module enables you to use the media library in custom forms without the Media Library Widget. The module does not properly check entity access in some circumstances. This may result in users with access to edit content seeing metadata about media items they are not authorized to access. The...

CVE-2012-10004

A vulnerability was found in backdrop-contrib Basic Cart on Drupal. It has been classified as problematic. Affected is the function basiccartcheckoutformsubmit of the file basiccart.cart.inc. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading t...

CVE-2012-10004

The CVE-2012-10004 entry describes a cross-site scripting vulnerability in the Drupal Backdrop-contrib Basic Cart component. Affected is the function basic_cart_checkout_form_submit in the file basic_cart.cart.inc, with remote exploit possible. Upgrading to version 1.x-1.1.1 addresses the issue; ...

Fedora 35 : drupal7-context (2022-288e2fa22b)

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-288e2fa22b advisory. - https://www.drupal.org/project/context/releases/7.x-3.11 - SA-CONTRIB-2022-049 Tenable has extracted the preceding description block directly from the Fedo...

Fedora 36 : drupal7-i18n (2022-91ce497459)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-91ce497459 advisory. - https://www.drupal.org/project/i18n/releases/7.x-1.31 - https://www.drupal.org/project/i18n/releases/7.x-1.30 -...

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2022-061

Social Flexible Group is an Open Social extension that allows users to create groups with many different configurations. In specific uncommon scenarios, where a platform doesn't have any flexible groups with the "Group members only secret" visibility, community groups are visible to anonymous use...

Social Base - Moderately critical - Access bypass - SA-CONTRIB-2022-060

The Social Base theme is designed as a base theme for Open Social. This base theme holds has a lot of sensible defaults. It doesn't however contain much styling. We expect developers to want to change this for their own project. When content within the Open Social distribution is placed within a...

Search API - Moderately critical - Information Disclosure - SA-CONTRIB-2022-059

This module enables you to build searches using a wide range of features, data sources and backends. The module doesn't in all cases correctly detect whether a given search is active on the current page, leading to potential information disclosure for some setups. This vulnerability is mitigated ...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the split function in contrib/shpsort.c. This could allow information exposure or code execution via manipulation of malloc. Remediation Upgrade shapelib to version 1.6.0 or higher. References - GitHub Commit - GitHub Iss...

AZL-37034 CVE-2022-0699 affecting package shapelib for versions less than 1.5.0-3

A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc...

Twig Field Value - Moderately critical - Access bypass - SA-CONTRIB-2022-058

This module enables themers to get partial data from field render arrays. It gives them more control over the output without drilling deep into the render array or using preprocess functions. The module doesn't sufficiently apply access restrictions when using the filters fieldlabel, fieldvalue,...

Commerce Elavon - Moderately critical - Access bypass - SA-CONTRIB-2022-053

This module enables you to accept payments from the Elavon payment provider. The module doesn't sufficiently verify that it's communicating with the correct server when using the Elavon On-site payment gateway, which could lead to leaking valid payment details as well as accepting invalid payment...

Malicious code in grunt-contrib-ugliyf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dee610f58dcdea004a68d2bbb239c6ffdab3d08270390b335f4ad371d383f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3474 Malicious code in grunt-contrib-ugliyf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dee610f58dcdea004a68d2bbb239c6ffdab3d08270390b335f4ad371d383f59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora: Security Advisory for golang-contrib-opencensus-resource (FEDORA-2022-5ef0bd9a27)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-contrib-opencensus-resource-0.1.2-8.fc36

Go packages for auto discovery of resource information in various environment s. The resourcekeys packages defines well-known type and label key strings that are used by the other packages...

Tagify - Moderately critical - Access bypass - SA-CONTRIB-2022-051

This module provides a widget to transform entity reference fields into a more user-friendly tags input component with a great performance. The module doesn't sufficiently check access for the add operation. Users with permission to edit content can view and reference unpublished terms. The edit...

Fedora: Security Advisory for golang-contrib-opencensus-resource (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...