37 matches found
Default credentials
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
CVE-2016-9452
The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL...
CVE-2016-9450
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context...
CVE-2016-9450
Removed by vendor...
CVE-2016-9452
Removed by vendor...
CVE-2016-9452
CVE-2016-9452 affects Drupal Core via the transliterate mechanism in Drupal 8.x (pre-8.2.3). A specially crafted URL can cause a denial of service, potentially stopping the application. Affected product: Drupal Core 8.x before 8.2.3. Root cause: issue in transliterate handling that can be trigger...
D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059
This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attack...
Cross site scripting
Cross-site scripting XSS vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception...
CVE-2016-7570
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes...
CVE-2016-7572
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors...
CVE-2016-7570
Vulnerability: Drupal 8.x before 8.1.10 exposes a permissions check flaw where users with node-edit rights can alter the visibility of comments on arbitrary nodes. Root cause: improper verification of the Administer comments permission. Impact: authenticated remote attackers could manipulate comm...
CVE-2016-7572
CVE-2016-7572 affects Drupal 8.x prior to 8.1.10, where the system.temporary route does not properly enforce the Export configuration permission, allowing remote authenticated users to bypass restrictions and read the full config export. Impact is sensitive information disclosure via an authentic...
CVE-2016-7571
CVE-2016-7571 is a Drupal XSS vulnerability affecting Drupal 8.x before 8.1.10. The issue allows remote attackers to inject arbitrary script or HTML via vectors related to handling HTTP exception messages. Documents corroborate the vulnerability under multiple sources (NVD entry, GHSA advisory, N...
Design/Logic Flaw
The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors...
Google Analytics - Moderately Critical - Cross Site Scripting - SA-CONTRIB-2016-042
This module enables you to add integration with Google Analytics statistics service. The module allows admin users to enter custom JavaScript snippets to add advanced tracking functionality. The permission required to enter this JavaScript was not marked as restricted. This vulnerability is...
CVE-2016-3162
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files...
