Design/Logic Flaw

The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern...

CVE-2015-8095

The CVE-2015-8095 issue affects Drupal—Monster Menus module versions 7.x-1.21 through 7.x-1.23. The recycle bin feature does not fully remove nodes from view, allowing exposure of sensitive information via an unspecified URL pattern. Mitigation: upgrade to Monster Menus 7.x-1.24 (the fixed versio...

CVE-2015-8095

The recycle bin feature in the Monster Menus module 7.x-1.21 before 7.x-1.24 for Drupal does not properly remove nodes from view, which allows remote attackers to obtain sensitive information via an unspecified URL pattern...

Mageia: Security Advisory (MGASA-2015-0425)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Drupal Field as Block Module Information Disclosure Vulnerability

Drupal is a free , open source content management system developed in PHP language . Field as Block is one of the fields used as a block and in the node display page configured to the various areas of the module . A security vulnerability exists in Drupal Field as Block that could be exploited by...

CVE-2015-8082

The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the userlogout function, which allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module, as demonstrated by the CAS and URL...

CVE-2015-8081

The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block...

Authentication flaw

The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the userlogout function, which allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module, as demonstrated by the CAS and URL...

Design/Logic Flaw

The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block...

CVE-2015-8081

The Field as Block module 7.x-1.x before 7.x-1.4 for Drupal might allow remote attackers to obtain sensitive field information by reading a cached block...

CVE-2015-8082

The CVE-2015-8082 issue affects Drupal’s Login Disable module (versions 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2). The root cause is improper loading of the user_logout function, allowing remote attackers to bypass the module’s logout protection when a contributed authentication module (...

CVE-2015-8082

The Login Disable module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly load the userlogout function, which allows remote attackers to bypass the logout protection mechanism by leveraging a contributed user authentication module, as demonstrated by the CAS and URL...

CVE-2015-8081

CVE-2015-8081 affects Drupal Field as Block module (7.x-1.x) prior to 7.x-1.4. The vulnerability allows remote attackers to disclose sensitive field information by reading a cached block, due to how the module caches block output and errors/permissions handling. Affected versions: Field as Block ...

[SECURITY] Fedora 22 Update: drupal7-7.41-1.fc22

Equipped with a powerful blend of features, Drupal is a Content Management System written in PHP that can support a variety of websites ranging from personal weblogs to large community-driven websites. Drupal is highly configurable, skinnable, and secure...

Drupal Entity Registration Module Information Disclosure Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Entity Registration is one of the user registration modules. An information disclosure vulnerability exists in the Drupal Entity Registration module in versions 7.x-1.6 prior to 7.x-1.x...

Drupal Stickynote module cross-site scripting vulnerability (CNVD-2015-07318)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Stickynote is one of the modules that annotates pages based on paths. A cross-site scripting vulnerability exists in the Drupal Stickynote module in versions 7.x-1.3 prior to 7.x-1.x. A...

Drupal User Dashboard Module SQL Injection Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.User Dashboard is one of the dashboard modules. A SQL injection vulnerability exists in the Drupal User Dashboard module in versions 7.x-1.x prior to 7.x-1.4. An attacker could use this...

Drupal core Overlay module open redirect vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Overlay is one of the modules that displays the Drupal administration interface at the top of the page. An open redirect vulnerability exists in the Overlay module in Drupal core 7.41 a...

Unspecified vulnerability in Drupal Taxonomy Find module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Taxonomy Find is one of the modules that provides a search interface for finding categories. A security vulnerability exists in the Drupal Taxonomy Find module. No details of the...

MGASA-2015-0425 Updated drupal package fixes security vulnerability

The Overlay module in Drupal core displays administrative pages as a layer over the current page using JavaScript, rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect...