Metatag - Moderately critical - Information disclosure - SA-CONTRIB-2019-058

This module enables you to customize meta tags to help with a site's search engine ranking and improve the display of page summaries when shared on social networks. The module doesn't sufficiently check for a site being in maintenance mode. This vulnerability is mitigated by the fact that the sit...

Meta tags quick - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-057

Metatags quick is a module that manages meta tags tags that appear in HTML's head section as Drupal 7 fields. Administration page of metatags quick does not sanitize the output of blocks that appear on the same page. This allows an attacker to inject malicious JavaScript in block markup. This...

Custom Permissions - Critical - Access bypass - SA-CONTRIB-2019-055

This module enables you to add and manage additional custom permissions through the administration UI. The module doesn't sufficiently check for the proper access permissions to this page. This vulnerability is mitigated by the fact that an attacker must know the route of the Custom Permissions...

Fedora 30 : drupal7-uuid (2019-9f613ab692)

https://www.drupal.org/project/uuid/releases/7.x-1.3 - https://www.drupal.org/sa-contrib-2019-052 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Easy Breadcrumb - Critical - Cross Site Scripting - SA-CONTRIB-2019-053

This module enables you to use the current URL path alias and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website. The module doesn't sufficiently sanitise user input in certain circumstances. This...

Fedora 29 : drupal7-xmlsitemap (2019-f219dbb548)

https://www.drupal.org/project/xmlsitemap/releases/7.x-2.6 - https://www.drupal.org/project/xmlsitemap/releases/7.x-2.5 - https://www.drupal.org/project/xmlsitemap/releases/7.x-2.4 - Moderately critical - Information Disclosure - SA-CONTRIB-2018-053 -...

Fedora 30 : drupal7-uuid (2019-e454116a1a)

https://www.drupal.org/project/uuid/releases/7.x-1.2 - https://www.drupal.org/project/uuid/releases/7.x-1.1 - Moderately critical - Arbitrary file upload - SA-CONTRIB-2018-045 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system...

Fedora 29 : drupal7-ds (2019-5258ea8ae2)

https://www.drupal.org/project/ds/releases/7.x-2.16 - https://www.drupal.org/project/ds/releases/7.x-2.15 - Critical - Cross site scripting XSS - SA-CONTRIB-2018-019 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website...

Fedora 29 : drupal7-context (2019-62eba285ee)

https://www.drupal.org/project/context/releases/7.x-3.10 - Moderately critical - Cross site scripting - SA-CONTRIB-2019-028 - https://www.drupal.org/project/context/releases/7.x-3.9 - https://www.drupal.org/project/context/releases/7.x-3.8 Note that Tenable Network Security has extracted the...

Fedora 29 : drupal7-module_filter (2019-0e10310204)

https://www.drupal.org/project/modulefilter/releases/7.x-2.2 - Moderately critical - Cross site scripting - SA-CONTRIB-2019-042 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically...

Fedora 30 : drupal7-xmlsitemap (2019-0b26efb6b8)

https://www.drupal.org/project/xmlsitemap/releases/7.x-2.6 - https://www.drupal.org/project/xmlsitemap/releases/7.x-2.5 - https://www.drupal.org/project/xmlsitemap/releases/7.x-2.4 - Moderately critical - Information Disclosure - SA-CONTRIB-2018-053 -...

TableField - Moderately critical - Access bypass and Cross Site Scripting - SA-CONTRIB-2019-051

This module allows you to attach tabular data to an entity. Access bypass There's no access check for users with an "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities. This vulnerability is mitigated by the fact that an attacker must ha...

Workflow - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-049

The Workflow module enables you to create arbitrary Workflows, and assign them to Entities. The module doesn't sufficiently escape HTML in the field settings leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

Opigno forum - Less critical - Access bypass - SA-CONTRIB-2019-046

In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are...

TableField - Critical - Remote Code Execution - SA-CONTRIB-2019-045

This module allows you to attach tabular data to an entity. The module doesn't sufficiently determine that the data being unserialized is the contents of a tablefield when users request a CSV export, which could lead to Remote Code Execution via Object Injection. This vulnerability is mitigated b...

Services - Less critical - Access bypass - SA-CONTRIB-2019-043

This module provides a standardized solution for building API's so that external clients can communicate with Drupal. The Services module has an access bypass vulnerability in its "attachfile" resource that allows users who have access to create or update nodes that include file fields to...

Module Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2019-042

This module enables you to filter the list of modules on the admin modules page, and organizes packages into vertical tabs. The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that the...

AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-039

This module enables you to add social media share buttons on your website to its content and pages. The module doesn't sufficiently mark its administration permission restricted, allowing cross site scripting vulnerabilities to users who have access to its admin settings. This vulnerability is...

Views (for Drupal 7) - Moderately critical - Information Disclosure - SA-CONTRIB-2019-034

This module enables you to create customized lists of data. The module doesn't sufficiently protect against argument definitions failing. This vulnerability is mitigated by the fact that a view must have custom PHP code used as a field validator...

Views (for Drupal 7) - Less critical - Cross site scripting - SA-CONTRIB-2019-036

This module enables you to create customized lists of data. The module doesn't sufficiently sanitize certain field types, leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that a view must display a field with the format "Full data serialized" and an...