519 matches found
Workbench Scheduler - Moderately Critical - Access Bypass - SA-CONTRIB-2016-049
Workbench Scheduler module provides users with the ability to create schedules that change moderated content from one workbench moderation state to another. An authenticated user could add a schedule to a node even when that content type has schedules disabled. The vulnerability is mitigated by t...
Hosting - Less Critical - Access bypass - SA-CONTRIB-2016-046
The Hosting module is a core component of the Aegir Hosting System. This install profile, and accompanying suite of modules, is a hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. The Hosting module does not sufficiently control access to any cust...
[SECURITY] Fedora 23 Update: drupal7-entity_translation-1.0-0.9.beta5.fc23
Allows fieldable entities to be translated into different languages, by introducing entity/field translation for the new translatable fields capability in Drupal 7. Maintained by the Drupal core i18n team. This project does not replace the Internationalization http://drupal.org/project/i18n...
[SECURITY] Fedora 24 Update: drupal7-entity_translation-1.0-0.9.beta5.fc24
Allows fieldable entities to be translated into different languages, by introducing entity/field translation for the new translatable fields capability in Drupal 7. Maintained by the Drupal core i18n team. This project does not replace the Internationalization http://drupal.org/project/i18n...
Fedora 23 : drupal7-features (2016-83189e6c2f)
7.x-2.10 - 7.x-2.9 - Denial of Service DoS - SA-CONTRIB-2016-020 - 7.x-2.8 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without...
[SECURITY] Fedora 24 Update: drupal7-features-2.10-1.fc24
The features module enables the capture and management of features in Drupa l. A feature is a collection of Drupal entities which taken together satisfy a certain use-case. Features provides a UI and API for taking different site building components from modules with exportables and bundling them...
Google Analytics - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-042
This module enables you to add integration with Google Analytics statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is...
[SECURITY] Fedora 24 Update: drupal7-views-3.14-1.fc24
You need Views if: You like the default front page view, but you find you want to sort it differently. You like the default taxonomy/term view, but you find you want to sort it differently; for example, alphabetically. You use /tracker, but you want to restrict it to posts of a certain type. You...
Drupal 7. x RESTWS module command execution vulnerability
No description provided by source...
Webform Multiple File Upload - Critical - Remote Code Execution - SA-CONTRIB-2016-038
The Webform Multiple File Upload module allows users to upload multiple files on a Webform. The Webform Multifile File Upload module contains a Remote Code Execution RCE vulnerability where form inputs will be unserialized and a specially crafted form input may trigger arbitrary code execution...
Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-002
Saving user accounts can sometimes grant the user all roles User module - Drupal 7 - Moderately Critical A vulnerability exists in the User module, where if some specific contributed or custom code triggers a rebuild of the user profile form, a registered user can be granted all user roles on the...
REST JSON - Multiple Vulnerabilities - Highly Critical - Unsupported - SA-CONTRIB-2016-033
This module enables you to expose content, users and comments via a JSON API. The module contains multiple vulnerabilities including Node access bypass Comment access bypass User enumeration Field access bypass User registration bypass Blocked user login Session name guessing Session enumeration...
Opening hours - Moderately Critical - XSS - SA-CONTRIB-2016-031
This module enables you to enter opening hours for locations in a highly detailed way. The module doesn't sufficiently escape input data from user input. This vulnerability is mitigated by the fact that an attacker must be able to edit opening hours by having a role with the permission “Edit...
Dropbox client - Multiple Vulnerabilities - SA-CONTRIB-2016-027
This module enables you to view dropbox files in your Drupal site. The module doesn't sufficiently sanitize filenames when displaying them to users or administrators leading to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must be able to...
Fieldable Panels Panes - Moderately Critical - XSS - SA-CONTRIB-2016-025
This module enables you to create fieldable entities that have special integration with Panels. The module doesn't sufficiently filter the entity title or admin title fields when they are displayed in either the Panels admin UI or the In-Place Editor IPE, allowing for specially crafted XSS attack...
Fedora 22 : drupal7-block_class-2.3-1.fc22 (2016-8d983eeb13)
7.x-2.3 The security update 2.2 broke very common class names, see 2636548: upgrade to 2.2 converts class underscore to dash. 7.x-2.2 Fixes Block Class- Critical - Cross Site Scripting XSS - SA- CONTRIB-2015-175 Note that Tenable Network Security has extracted the preceding description block...
Search API - Moderately Critical - Multiple Vulnerabilities - SA-CONTRIB-2016-022
This module enables you to build searches using a wide range of features, data sources and backends. Search index not updated by node access changes The module doesn't sufficiently re-index nodes when using the "Node access" or "Access check" data alterations and non-standard ways of changing nod...
Features - Less Critical - Denial of Service (DoS) - SA-CONTRIB-2016-020
This module enables you to organize and export configuration data. The module doesn't sufficiently protect the admin/structure/features/cleanup path with a token. If an attacker can trick an admin with the "manage features" permission to request a special URL, it could lead to clearing the cache...
CVE-2016-3162
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files...