14567 matches found
JavaScript cross-site scripting prevention is incomplete.
More info at https://www.drupal.org/SA-CORE-2018-001...
External link injection on 404 pages when linking to the current page.
More info at https://www.drupal.org/SA-CORE-2018-001...
Comment reply form allows access to restricted content.
More info at https://www.drupal.org/SA-CORE-2018-001...
Entity Backup - Critical - Module Unsupported - SA-CONTRIB-2018-012
The main purpose of the Entity Backup module is to keep a backup of deleted Drupal core entities and perform recovery of them. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to...
Entity API - Moderately critical - Information Disclosure - SA-CONTRIB-2018-013
The Entity API module extends the entity API of Drupal core in order to provide a unified way to deal with entities and their properties. The module prints debugging information to the HTML output in certain error conditions thereby causing an information disclosure vulnerability. This...
DRUPAL-CONTRIB-2018-008
This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content o...
Drupal Open Atrium Module Cross-Site Request Forgery Vulnerability
Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform. Multiple cross-site request forgery vulnerabilities exist in subcomponents of the Drupal Open...
Drupal Open Atrium module Discussions sub module security vulnerability
Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a collaborative team development module based on the Drupal platform.Discussions sub module is one of the sub-modules. A security vulnerability exists in the...
Drupal Open Atrium Module OG Subgroups Module Access Bypass Vulnerability
Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Open Atrium module is a teamwork development module based on the Drupal platform.OG Subgroups module is one of the OG subgroups module. A security vulnerability exists in the OG...
CVE-2014-9504
The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance...
Design/Logic Flaw
The OG Subgroups module, when used with the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal, allows remote attackers to access child groups via vectors related to membership inheritance...
CVE-2014-9503
The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote attackers to hijack the authentication of unknown victims via vectors related to menu callbacks...
CVE-2014-9502
Multiple cross-site request forgery CSRF vulnerabilities in unspecified sub modules in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allow remote attackers to hijack the authentication of unknown victims via vectors related to menu callbacks...
Improper access control
The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks...
CVE-2014-9504
CVE-2014-9504 affects Drupal Open Atrium’s OG Subgroups module. When used with Open Atrium 7.x-2.x prior to 7.x-2.26, it allows a remote attacker to access child groups via vectors related to membership inheritance. Documents confirm the vulnerable configuration and the affected version range; no...
CVE-2014-9502
CVE-2014-9502 covers multiple CSRF vulnerabilities in the Open Atrium module for Drupal 7.x-2.x (pre-7.x-2.26). Affected: Open Atrium 7.x-2.x before 7.x-2.26; vulnerability exists in unspecified submodules and relates to menu callbacks, allowing remote attackers to hijack other users’ sessions. E...
CVE-2014-9503
CVE-2014-9503 affects the Open Atrium 7.x-2.x Discussions sub module (pre-7.x-2.26). The vulnerability allows remote authenticated users with "access content" permissions to modify arbitrary nodes due to improper access checks on unspecified AJAX callbacks. Impact is limited to Drupal/Open Atrium...
CVE-2014-9503
The Discussions sub module in the Open Atrium module 7.x-2.x before 7.x-2.26 for Drupal allows remote authenticated users with "access content" permissions to modify arbitrary nodes by leveraging improper access checks on unspecified ajax callbacks...