Fedora Update for drupal7 FEDORA-2011-10020

The remote host is missing an update for the SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Drupal 7.x Search Module Path Disclosure

Drupal 7.x Search Module - Full Path Disclosure ============== Summary Full path disclosure due to insufficient input validation in the search module. ============== Description Performing a search with the "keys" parameter set as an array, an error message shows the full path of the Drupal...

Fedora 15 : drupal7-7.12-1.fc15 (2012-1250)

This package includes security updates from upstream 7.11 as well as additional bug fixes. Refer to upstream notes for more information : - http://drupal.org/node/1425092 - http://drupal.org/node/1425104 Note that Tenable Network Security has extracted the preceding description block directly fro...

Fedora 16 : drupal7-7.12-1.fc16 (2012-1268)

This package includes security updates from upstream 7.11 as well as additional bug fixes. Refer to upstream notes for more information : - http://drupal.org/node/1425092 - http://drupal.org/node/1425104 Note that Tenable Network Security has extracted the preceding description block directly fro...

[SECURITY] Fedora 16 Update: drupal7-field_permissions-1.0-0.2.beta2.fc16

The Field Permissions module is a drop-in replacement for the Content Permissions module shipped with CCK. It allows site administrators to set field-level permissions to edit or view CCK fields in any node, and optionally new feature compared to Content Permissions module, edit field during node...

drupal -- multiple vulnerabilities

Drupal development team reports: Cross Site Request Forgery vulnerability in Aggregator module CVE: CVE-2012-0826 An XSRF vulnerability can force an aggregator feed to update. Since some services are rate-limited e.g. Twitter limits requests to 150 per hour this could lead to a denial of service...

SA-CONTRIB-2012-003 - Fill PDF - Multiple vulnerabilities

CVE: CVE-2012-1625 This module enables you to populate fillable PDF templates with data from nodes and webforms. Access bypass 7.x only Incorrectly-ordered arguments in a call to the function that handles the main functionality of the module makes it possible for an attacker to trigger any PDF to...

SA-CONTRIB-2011-056 - Webform Validation Cross Site Scripting

The Webform Validation module enables you to add form validation rules to Webform components through a UI. The module contains multiple cross site scripting XSS vulnerabilities due to the fact that it fails to sanitize certain user entered text prior to displaying in the browser. This vulnerabili...

SA-CONTRIB-2011-035 Forward module - Open redirect

The Forward module enables you to add a "forward this page" link to each node. The link takes regular site visitors to a form where they can generate an email to a friend. The module doesn't check to ensure that the page being forwarded refers to an internal path. This could allow someone to hard...

CVE-2011-2687

Drupal 7.x before 7.3 allows remote attackers to bypass intended nodeaccess restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table...

Design/Logic Flaw

Drupal 7.x before 7.3 allows remote attackers to bypass intended nodeaccess restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table...

CVE-2011-2687

Drupal 7.x before 7.3 allows remote attackers to bypass intended nodeaccess restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table...

CVE-2011-2687

Removed by vendor...

SA-CORE-2011-003 - Drupal core - Access bypass

CVE: CVE-2011-2726 Access bypass in private file fields on comments. Drupal 7 contains two new features: the ability to attach File upload fields to any entity type in the system and the ability to point individual File upload fields to the private file directory. If a Drupal site is using these...

Fedora 15 : drupal7-7.4-1.fc15 (2011-8878)

Remember to log in as user 1 prior to the RPM update, to perform the DB upgrade via http://yoursite/update.php. - Advisory ID: DRUPAL-SA-CORE-2011-002 - Project: Drupal core 1 - Version: 7.x - Date: 2011-JUNE-29 - Security risk: Highly critical 2 - Exploitable from: Remote - Vulnerability: Access...

[SECURITY] Fedora 14 Update: drupal7-7.2-1.fc14

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

SA-CORE-2011-001 - Drupal core - Multiple vulnerabilities

CVE: CVE-2011-2687 Multiple vulnerabilities and weaknesses were discovered in Drupal. Reflected cross site scripting vulnerability in error handler A reflected cross site scripting vulnerability was discovered in Drupal's error handler. Drupal displays PHP errors in the messages area, and a...

SA-CONTRIB-2011-021 - Webform - Multiple Vulnerabilities

Webform module enables you to create custom webform or survey nodes. These nodes typically may be created either by editorial teams or administrators. Webform does not sufficiently check directory access when a user configures an upload field. This may allow a user to upload malicious files to th...

SA-CONTRIB-2011-017 - Save Draft - Validation Bypass

The Save Draft module adds a "Save as draft" button to the node form, letting content creators easily save a post in unpublished draft form. The module adds validation to individual form actions, thereby bypassing any form-wide validation that is normally performed before saving content. This is ...

SA-CONTRIB-2011-005 - AES encryption - Information disclosure

Due to a piece of code used for debugging mistakenly left in the release, the plain text password of the user who last logged in is written to a text file in the Drupal root directory. This file is remotely accessible, thus an attacker with the knowledge of which user last logged in may access th...