Fedora 24 : drupal7-panels (2016-c01e32e071)

7.x-3.6 - 7.x-3.7 - Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 23 : drupal7-panels (2016-703a5e621c)

7.x-3.6 - 7.x-3.7 - Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Flag - Moderately Critical - Access Bypass - SA-CONTRIB-2016-050

Flag enables users to mark content with any number of admin-defined flags, such as 'bookmarks' or 'spam'. Flag Bookmark is a submodule within Flag, which provides a 'bookmarks' flag, and default views to list bookmarked content. The provided view that lists each user's bookmarked content as a tab...

Panels - Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-047

Panels does not check access on some routes Critical Panels allows users with certain permissions to modify the layout and panel panes on pages or entities utilizing panels. Much of the functionality to modify these panels rely on backend routes that call administrative forms. These forms did not...

Hosting - Less Critical - Access bypass - SA-CONTRIB-2016-046

The Hosting module is a core component of the Aegir Hosting System. This install profile, and accompanying suite of modules, is a hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. The Hosting module does not sufficiently control access to any cust...

Administration Views - Critical - Access bypass - SA-CONTRIB-2016-041

Administration Views module replaces overview/listing pages with actual views for superior usability. The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have access to. CVE identifiers issued ACVE identifier...

Drupal Module Coder 7.x-1.37.x-2.6 - Remote Code Execution

Drupal Module Coder 7.x-1.37.x-2.6 - Remote Code Execution array "coderupgrade" = array "module" = "color", "files" = array"color.module" , "extensions" = array"module", "items" = array array"olddir"="test; $cmd;", "newdir"="test", "paths" = array "modulesbase" = "../../../", "filesbase" =...

Drupal Module Coder < 7.x-1.3 / 7.x-2.6 - Remote Code Execution (SA-CONTRIB-2016-039)

Exploit for php platform in category remote exploits array "coderupgrade" = array "module" = "color", "files" = array"color.module" , "extensions" = array"module", "items" = array array"olddir"="test; $cmd;", "newdir"="test", "paths" = array "modulesbase" = "../../../", "filesbase" =...

Drupal Module Coder < 7.x-1.3/7.x-2.6 - Remote Code Execution

array "coderupgrade" = array "module" = "color", "files" = array"color.module" , "extensions" = array"module", "items" = array array"olddir"="test; $cmd;", "newdir"="test", "paths" = array "modulesbase" = "../../../", "filesbase" = "../../../../sites/default/files" ; $payload = serialize$a;...

Drupal Coder RCE Vulnerability (SA-CONTRIB-2016-039) - Active Check

Drupal is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; if...

RESTWS - Highly critical - Remote code execution - SA-CONTRIB-2016-040

This module enables you to expose Drupal entities as RESTful web services. RESTWS alters the default page callbacks for entities to provide additional functionality. A vulnerability in this approach allows an attacker to send specially crafted requests resulting in arbitrary PHP execution. There...

Vulnerabilities of the Debian GNU/Linux operating system that allow a remote attacker to compromise the integrity of protected information

The tdiary-contrib package in the Debian GNU/Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to the compromise of protected information. These vulnerabilities can be exploited remotely...

Instagram Block - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-037

This module enables you to authenticate with Instagram's API via an intermediary service instagram.yanniboi.com. The module doesn't sufficiently advise that your authentication tokens could be intercepted. CVE identifiers issued ACVE identifier will be requested, and added upon issuance, in...

HybridAuth - Less critical - Multiple vulnerabilities - SA-CONTRIB-2016-018

The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. Open redirect The module doesn't verify the "destination" redirect after a login to be a non-external URL causing an ope...

Drupal Commerce - Less Critical - Information disclosure - SA-CONTRIB-2016-019

This module enables you to build an online store that uses nodes to display products through the use of product reference fields. The default widget for those fields is an autocomplete textfield similar to the taxonomy term reference field's autocomplete widget. As you type in the textfield, the...

Scald File - Critical - Remote Code Execution - SA-CONTRIB-2016-015

When a PDF is uploaded in Scald File, various tools can be executed if they're installed on the server, to try to generate a thumbnail out of that PDF. This is mitigated by the need to have the sufficient permissions to upload a file in Scald, and also to have at least one of the thumbnail creati...

Fedora 21 : drupal7-jquery_update-2.7-1.fc21 (2015-bf4adb12aa)

See jQuery Update - Less Critical - Open Redirect - SA- CONTRIB-2015-158 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Fedora 23 : drupal7-jquery_update-2.7-1.fc23 (2015-c2f6872886)

See jQuery Update - Less Critical - Open Redirect - SA- CONTRIB-2015-158 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

Google Analytics Counter - Moderately Critical - CSRF - SA-CONTRIB-2016-011

The Google Analytics Counter module provides total pageview counts for each page on a website. In that it is similar to the core Statistics module counter, but it is much lighter and ultimately faster because it draws on data from Google Analytics. This is why it is also able to effortlessly coun...

RedHen CRM - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-002

The Redhen set of modules allows you to build a CRM features in a Drupal site. When rendering individual Contacts, this module does not properly filter the certain data prior to display. When rendering listing of notes or engagement scores, these modules do not properly filter certain data before...