Drupal Tripal BLAST UI Module Remote Code Execution Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A remote code execution vulnerability exists in the Drupal Tripal BLAST UI module, which can be exploited by an attacker to execute arbitrary code in the context of an...

Like/Dislike - Critical - Cross Site Request Forgery - SA-CONTRIB-2016-056

Cross Site Request Forgery Like/Dislike module can be used to Like and Dislike actions on any content. It is powered by Drupal field concept. The module does not verify user intent on like/dislike links thereby exposing a Cross Site Request Forgery CSRF vulnerability. CVE identifiers issued ACVE...

Workbench Moderation - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-060

This module enables you to create and manage custom editorial workflows around a site's content. The module could result in unpublished content being temporarily made visible via content lists, e.g. as generated by Views, when its editorial status was being changed, e.g. from "draft" to "needs...

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059

This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attack...

Drupal 7.x < 7.19 Multiple Vulnerabilities

Binary data 9725.prm...

Drupal 7.x < 7.13 Multiple Vulnerabilities

Binary data 9724.prm...

Drupal 7.x < 7.24 Multiple Vulnerabilities

Binary data 9727.prm...

Drupal 7.x < 7.20 DoS

Binary data 9726.prm...

Drupal 7.x < 7.34 DoS

Binary data 9728.prm...

Drupal 8.1.x < 8.1.10 Multiple Vulnerabilities

Binary data 9729.prm...

Drupal Elysia Cron Module Cross-Site Scripting Vulnerability

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP language , Elysia Cron is one of the cron job management module . A cross-site scripting vulnerability exists in several versions of Elysia Cron, which can be exploited by attackers ...

Tripal BLAST UI - Highly Critical - Remote Code Execution - SA-CONTRIB-2016-054

This module enables you to run NCBI BLAST jobs on the host system. The module doesn't sufficiently validate advanced options available to users submitting BLAST jobs, thereby exposing the ability to enter a short snippet of shell code that will be executed when the BLAST job is run. This...

Drupal Webform Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An access bypass vulnerability exists in Drupal Webform Module, which can be exploited by an attacker to bypass certain security mechanisms and perform unauthorized...

Webform - Less Critical - Access Bypass - SA-CONTRIB-2016-053

This module provides a user interface to create and configure forms called Webforms. When using forms with private file uploads, Webform wasn't explicitly denying access to files it managed which could allow access to be granted by other modules. The vulnerability is mitigated by the fact that...

Drupal 8.x < 8.1.10 Multiple Vulnerabilities

The version of Drupal running on the remote web server is 8.x prior to 8.1.10. It is, therefore, affected by multiple vulnerabilities : - A flaw exists due to improper checking for 'Administrator comments' permissions, which allows users who have rights to edit a node to set the visibility for...

Elysia Cron - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-052

This module enables you to manage cron jobs. The module doesn't sufficiently sanitize the cron rules which are entered into "Predefined rules" field thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the...

CivicRM SQL Injection Vulnerability

Drupal is a free, open source content management system developed in PHP. webform CiviCRM Integration is one of the modules that integrate Webform and CiviCRM. A SQL injection vulnerability exists in CivicRM 4.7b3, which allows an attacker to download database content after authentication...

Drupal Core Access Bypass Vulnerability (CNVD-2016-08687)

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A security vulnerability in the system.temporary route in version 8.x of Drupal prior to 8.1.10 can be exploited by a remote attacker to bypass established access...

Drupal Multiple Vulnerabilities (SA-CORE-2016-004) - Windows

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...

Drupal Multiple Vulnerabilities (SA-CORE-2016-004) - Linux

Drupal is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:drupal:drupal"; ifdescription...