Critical RCE Bugs Patched in Drupal 7 and 8

Drupal is urging users to upgrade to the latest release that fixes two critical remote code execution bugs impacting Drupal 7 and Drupal 8. Developers have also identified three additional “moderately critical” vulnerabilities. “A remote attacker could exploit some of these vulnerabilities to tak...

LimeSurvey cross-site scripting vulnerability (CNVD-2018-12261)

LimeSurvey formerly known as PHPSurveyor is a set of open source online survey program developed by the LimeSurvey team, which supports survey program development, questionnaire distribution and data collection. A cross-site scripting vulnerability exists in Boxes in LimeSurvey version...

CVE-2015-2749

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

CVE-2015-2749: URL Redirection to Untrusted Site

Open redirect vulnerability in Drupal 6.x before 6.35 and 7.x before 7.35 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination parameter...

Proxmox Mail Gateway Open Redirect Vulnerability

Proxmox Mail Gateway is an e-mail gateway product from Proxmox Server Solutions, Austria. The product protects e-mail from virus, phishing and Trojan horse threats. An open redirection vulnerability exists in versions prior to Proxmox Mail Gateway hotfix 4.0-8-097d26a9. A remote attacker can...

CVE-2015-9058

Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter...

PT-2017-7539

Name of the Vulnerable Software and Affected Versions Proxmox Mail Gateway versions prior to 4.0-8-097d26a9 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter. This can be exploited to trick users into...

CVE-2015-9058: URL Redirection to Untrusted Site

Open redirect vulnerability in Proxmox Mail Gateway prior to hotfix 4.0-8-097d26a9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter...

PT-2016-5396

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.38 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a double-encoded URL in the destination parameter of the drupal goto...

Drupal Core double-encoded 'destination' parameter open redirect vulnerability

Drupal is a free and open source content management system developed in PHP. An open redirection vulnerability exists in the Drupal Core double encoding of the 'destination' parameter.The Drupal 6 'drupalgoto' function fails to correctly decode the content of $REQUEST'destination' when used,...

Open redirect via double-encoded 'destination' parameter

More info at https://www.drupal.org/SA-CORE-2016-001...

Open redirect via double-encoded 'destination' parameter

More info at https://www.drupal.org/SA-CORE-2016-001...

Fedora 22 : drupal7-path_breadcrumbs-3.3-1.fc22 (2015-11858)

7.x-3.3 See SA-CONTRIB-2015-133 - New token %site:current-page:path-menu-trail:pb-join: is an alternative approach to build breadcrumbs based on path hierarchy. - Fixed 2473109: Destination parameter is present but doesn't work during editing breadcrumb - Other improvements and fixes. Note that...

Fedora 21 : drupal7-path_breadcrumbs-3.3-1.fc21 (2015-11836)

7.x-3.3 See SA-CONTRIB-2015-133 - New token %site:current-page:path-menu-trail:pb-join: is an alternative approach to build breadcrumbs based on path hierarchy. - Fixed 2473109: Destination parameter is present but doesn't work during editing breadcrumb - Other improvements and fixes. Note that...

Drupal Node Invite Module Open Redirect Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Node Invite is one of the modules that is similar to RSVP sending invitations via email. An open redirection vulnerability exists in the Drupal Node Invite module versions prior to...

CVE-2015-3358: Undefined Security Weakness

Multiple open redirect vulnerabilities in the Tadaa! module before 7.x-1.4 for Drupal allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter, related to callbacks that 1 enable and disable modules or 2 change variables...

CVE-2015-3371: Undefined Security Weakness

Open redirect vulnerability in the Node Invite module before 6.x-2.5 for Drupal allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter...

PT-2015-6163

Name of the Vulnerable Software and Affected Versions Ubercart Currency Conversion module version 6.x-1.2 and earlier Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the destination query parameter. This can be...

PT-2015-6179

Name of the Vulnerable Software and Affected Versions Tadaa! module versions prior to 7.x-1.4 for Drupal Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a destination parameter. This is related to callbacks that enab...

PT-2015-6192

Name of the Vulnerable Software and Affected Versions Drupal Node Invite module versions prior to 6.x-2.5 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the destination parameter. This can be exploited to trick users into...