[ASA-201611-20] drupal: multiple issues

Arch Linux Security Advisory ASA-201611-20 ========================================== Severity: Medium Date : 2016-11-19 CVE-ID : CVE-2016-9449 CVE-2016-9450 CVE-2016-9452 Package : drupal Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE Summary ======= The...

Drupal Fixes 'Moderately Critical' Vulnerabilities in Core Engine

The Drupal Security Team fixed a handful of issues in version 7 and 8 of its content management system core engine this week that could have led to cache poisoning, social engineering attacks and a denial of service condition. Drupal SA-CORE-2016-005 – Moderately Critical Update to Drupal core 7....

Drupal Core Denial of Service Vulnerability (CNVD-2016-11384)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A denial-of-service vulnerability exists in Drupal Core, which can be exploited by attackers to cause a denial-of-service attack...

Drupal Core Security Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security bypass vulnerability exists in Drupal Core, which can be exploited by attackers to bypass security restrictions and perform unauthorized operations...

Drupal Core Information Disclosure Vulnerability (CNVD-2016-11385)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An information disclosure vulnerability exists in Drupal Core, which can be exploited by attackers to obtain sensitive information...

DSA-3718-1 drupal7 - security update

Bulletin has no description...

Denial of service via transliterate mechanism

More info at https://www.drupal.org/SA-CORE-2016-005...

Incorrect cache context on password reset page

More info at https://www.drupal.org/SA-CORE-2016-005...

Inconsistent name for term access query

More info at https://www.drupal.org/SA-CORE-2016-005...

Inconsistent name for term access query

More info at https://www.drupal.org/SA-CORE-2016-005...

Denial of service via transliterate mechanism

More info at https://www.drupal.org/SA-CORE-2016-005...

Drupal Code -- Multiple Vulnerabilities

The Drupal development team reports: Inconsistent name for term access query Less critical - Drupal 7 and Drupal 8 Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by...

Drupal Core - Moderately Critical - Multiple Vulnerabilities - SA-CORE-2016-005

Description Inconsistent name for term access query Less critical - Drupal 7 and Drupal 8 Drupal provides a mechanism to alter database SELECT queries before they are executed. Contributed and custom modules may use this mechanism to restrict access to certain entities by implementing...

Drupal D8 Editor File upload module cross-site scripting vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.File is one of the file handling modules. A cross-site scripting vulnerability exists in the Drupal D8 Editor File upload module that stems from a failure to properly validate user inpu...

Drupal Workbench Moderation Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.The Workbench Moderation module enables you to customize the editorial workflow in your website. An information disclosure vulnerability exists in the Drupal Workbench Moderation module...

Drupal Views Send Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. View sending enables you to send emails to multiple users from a single view. A cross-site scripting vulnerability exists in the Drupal Views Send module due to the program failing to...

Views Send - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-061

The Views Send module enables you to send mail to multiple users from a View. The module doesn't sufficiently filter potential user-supplied data when previewing the e-mail which can lead to a Cross Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker mus...

Menu Views - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-055

This module enables users to create menu items that render views instead of links. This is useful for creating "mega-menus". The module doesn't sufficiently filter title and breadcrumb fields for possible cross-site scripting. This vulnerability is mitigated by the fact that an attacker must have...

Bootstrap - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-058

The Bootstrap theme enables you to integrate the Bootstrap framework with Drupal. The theme does not sufficiently filter potential user-supplied data when it's passed to certain templates can which lead to a Persistent Cross Site Scripting XSS vulnerability. CVE identifiers issued ACVE identifier...

Drupal Tripal BLAST UI Module Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in the Drupal Tripal BLAST UI module, which can be exploited by an attacker to execute arbitrary code in the context of an...