Mandriva Linux Security Advisory : drupal (MDVSA-2014:031)

Multiple security issues was identified and fixed in drupal : The OpenID module in Drupal 6.x before 6.30 and 7.x before 7.26 allows remote OpenID users to authenticate as other users via unspecified vectors CVE-2014-1475. The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earli...

MGASA-2014-0031 Updated drupal package fixes security vulnerabilities

Christian Mainka and Vladislav Mladenov reported a vulnerability in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts CVE-2014-1475. Matt Vance and Damien Tournoud reported an access bypass vulnerability in the...

CVE-2014-1476

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page...

CVE-2014-1476

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page...

UBUNTU-CVE-2014-1476

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page...

CVE-2014-1476

The Taxonomy module in Drupal 7.x before 7.26, when upgraded from an earlier version of Drupal, does not properly restrict access to unpublished content, which allows remote authenticated users to obtain sensitive information via a listing page...

plone -- Remote Security Bypass

Plone developer reports: This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site's administration controls, view unpublished content, create new content and modify a site's skin. The sandbox protecting access to the underlying system is still ...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content...

CVE-2009-4517

Cross-site request forgery CSRF vulnerability in the FAQ Ask module 5.x and 6.x before 6.x-2.0, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that access unpublished content...

CVE-2009-4517

The CVE-2009-4517 issue affects the Drupal module FAQ Ask (versions 5.x and 6.x prior to 6.x-2.0). It is a CSRF vulnerability that allows remote attackers to hijack the authentication of arbitrary users for requests accessing unpublished content. The vulnerability is network-exploitable with no r...

Design/Logic Flaw

Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and 1 read unpublished content from anonymous users when a view is already configured to display the content, and 2 read private content in generated queries...

CVE-2009-2077

Drupal 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to bypass access restrictions and 1 read unpublished content from anonymous users when a view is already configured to display the content, and 2 read private content in generated queries...

[SA19018] Issue Dealer Unpublished Content Disclosure Weakness

TITLE: Issue Dealer Unpublished Content Disclosure Weakness SECUNIA ADVISORY ID: SA19018 VERIFY ADVISORY: http://secunia.com/advisories/19018/ CRITICAL: Not critical IMPACT: Security Bypass WHERE: From remote SOFTWARE: Issue Dealer 0.x http://secunia.com/product/8384/ DESCRIPTION: A weakness has...