CVE-2014-5249

SQL injection vulnerability in the "Biblio self autocomplete" submodule in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-5250

Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to access data via unspecified vectors...

Sql injection

SQL injection vulnerability in the "Biblio self autocomplete" submodule in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Code injection

Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to access data via unspecified vectors...

CVE-2014-5249

SQL injection vulnerability in the "Biblio self autocomplete" submodule in the Biblio Autocomplete module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-5249

The vulnerability CVE-2014-5249 affects the Drupal Biblio Autocomplete module, specifically the submodule Biblio self autocomplete in versions 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5. The root cause is insufficient sanitization of user input in the Biblio self autocomplete submodule, wh...

CVE-2014-5250

The CVE-2014-5250 issue affects the Drupal Biblio Autocomplete module (6.x-1.x prior to 6.x-1.1 and 7.x-1.x prior to 7.x-1.5). The Drupal SA indicates an AJAX autocompletion vulnerability in the Biblio Autocomplete submodule, enabling data access by remote users (including anonymous) via unspecif...

SA-CONTRIB-2014-078 - Notify - Access bypass

The notify module allows users to subscribe to periodic emails which include all new or revised content and/or comments of specific content types, much like the daily newsletters sent by some websites. The Notify module does not sufficiently check whether the user has access to recently added or...

Drupal 6.x < 6.33 / 7.x < 7.31 XML-RPC DoS

The remote web server is running a version of Drupal that is 6.x prior to 6.33 or 7.x prior to 7.31. It is, therefore, potentially affected by multiple denial of service vulnerabilities : - The XML-RPC library in Drupal allows entity declarations without considering recursion during entity...

SA-CONTRIB-2014-077 - TableField - Cross Site Scripting (XSS)

This module enables you to create a field attached to a entity which stores tabular data. The module doesn't sufficiently sanitize the field help text when presented to a privileged user. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer...

MGASA-2014-0329 Updated drupal packages fix security vulnerability

A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint. The drupal package has been updated to version 7.31 to fix this issue and other bugs. See the upstream advisory and release notes for more details...

Updated drupal packages fix security vulnerability

A denial of service issue exists in Drupal before 7.31, due to XML entity expansion in a publicly accessible XML-RPC endpoint. The drupal package has been updated to version 7.31 to fix this issue and other bugs. See the upstream advisory and release notes for more details...

[SECURITY] Fedora 20 Update: drupal7-views-3.8-1.fc20

The views module provides a flexible method for Drupal site designers to control how lists of content nodes are presented. Traditionally, Drupal has hard-coded most of this, particularly in how taxonomy and tracker lists are formatted. This tool is essentially a smart query builder that, given...

[SECURITY] [DSA 2999-1] drupal7 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2999-1 [email protected] http://www.debian.org/security/ Salvatore Bonaccorso August 09, 2014 http://www.debian.org/security/faq -...

Drupal /xmlrpc.php 拒绝服务漏洞 poc

早在2012 年 12 月 17 日一些采用 PHP 的知名博客程序 WordPress被曝光存在严重的漏洞，该漏洞覆盖WordPress 全部已发布的版本（包括WordPress 3.8.1）。该漏洞的 WordPress 扫描工具也在很多论坛和网站发布出来。工具可以利用 WordPress 漏洞来进行扫描，也可以发起DDoS 攻击。经过测试，漏洞影响存在 xmlrpc.php 文件的全部版本。 Pingback 是三种类型的反向链接中的一种，当有人链接或者盗用作者文章时来通知作者的一种方法。可以让作者了解和跟踪文章被链接或被转载的情况。一些全球最受欢迎的 blog 系统比如...

Updated drupal packages fix security vulnerabilities

An information disclosure vulnerability was discovered in Drupal before 7.27. When pages are cached for anonymous users, form state may leak between anonymous users. Sensitive or private information recorded for one anonymous user could thus be disclosed to other users interacting with the same...

Millions of WordPress and Drupal Websites Vulnerable to DoS Attack

Users running the website on a self-hosted WordPress or on Drupal are strongly recommended to update their websites to the latest version immediately. A moderately critical vulnerability was discovered in the way Drupal and WordPress implement XMLRPC, which can lead an attacker to disable your...

CVE-2014-5179

The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for 1 nodes or 2 users, which allows remote attackers to obtain sensitive information via a crafted link...

Design/Logic Flaw

The freelinking module for Drupal, as used in the Freelinking for Case Tracker module, does not properly check access permissions for 1 nodes or 2 users, which allows remote attackers to obtain sensitive information via a crafted link...

CVE-2014-5179

The Drupal freelinking and Freelinking Case Tracker contributed modules contain an access control bypass flaw: the modules do not sufficiently check permissions when displaying links to nodes and users, enabling remote retrieval of sensitive information via crafted links. This affects all version...