CVE-2017-16225

aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user that performed a aegir-release GitHub token...

Code injection

aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user that performed a aegir-release GitHub token...

CVE-2017-16225

aegir is a module to help automate JavaScript project management. Version 12.0.0 through and including 12.0.7 bundled and published to npm the user that performed a aegir-release GitHub token...

CVE-2017-16225

The CVE-2017-16225 issue affects the aegir package (Node.js module for JS project automation). Affected versions 12.0.0–12.0.7 reportedly cause the a e g i r - r e l e a s e flow to publish the user’s GitHub token to npm. Root cause is leakage of credentials during release, leading to potential c...

Github Token Leak

Overview Affected versions of aegir bundle and publish the current users github token to npm when aegir-release is executed. Recommendation Update to version 12.0.8 or later. If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked...

Hosting - Less Critical - Access bypass - SA-CONTRIB-2016-046

The Hosting module is a core component of the Aegir Hosting System. This install profile, and accompanying suite of modules, is a hosting system that sits alongside a LAMP or LEMP server to create, deploy and manage Drupal sites. The Hosting module does not sufficiently control access to any cust...

CVE-2015-5501

The CVE covers Drupal’s Hostmaster (Aegir) module (6.x-2.x before 6.x-2.4 and 7.x-3.x before 7.x-3.0-beta2). The underlying issue allows remote attackers to execute arbitrary PHP code by placing a crafted file in the directory used to write Apache vhost files for hosted sites in a multi-site envi...

Drupal Hostmaster (Aegir) 模块安全绕过漏洞

Bugtraq ID:61327 CNCAN ID：CNCAN-2013071902 Drupal是使用PHP语言编写的开源内容管理框架，它由内容管理系统和PHP开发框架共同构成 Drupal Hostmaster在运行任务时没有进行正确的授权，允许攻击者利用漏洞绕过限制访问其他受限功能 0 Drupal Hostmaster Aegir Module 6.x 厂商解决方案 Drupal Hostmaster Aegir Module 6.x-1.10已经修复此漏洞，建议用户下载更新： http://community.aegirproject.org/1.10...

SA-CONTRIB-2013-059 - Hostmaster (Aegir) - Access Bypass

This install profile and accompanying suite of modules enables you to install, upgrade, deploy, and backup Drupal sites among other things. The module doesn't sufficiently control access to running tasks on sites, under the scenario where a user successfully guesses a sites' path in the Aegir...

CVE-2012-2707

CVE-2012-2707 affects the Hostmaster (Aegir) Drupal module (6.x-1.x) prior to 6.x-1.9. The issue is that the module does not properly exit when users lack access to package/task nodes, allowing remote attackers to bypass access restrictions and edit unauthorized nodes. This is a server-side acces...

SA-CONTRIB-2012-080 - Hostmaster (Aegir) - Access Bypass and Cross Site Scripting (XSS)

Cross Site Scripting CVE: CVE-2012-2708. Hostmaster displays a log from tasks executed in Aegir's backend component, provision. In certain circumstances these log messages were not escaped properly before being displayed to the user. This vulnerability is mitigated by the fact that people wishing...

SA-CONTRIB-2011-041 - Hostmaster (Aegir) - Cross Site Scripting

Hostmaster Aegir provides a system for managing Drupal sites. The theme in Hostmaster, Eldir, does not sanitize the custom body classes correctly leading to a cross site scripting XSS vulnerability that can be exploited when a user is made to view a specially crafted URL. If the user is logged in...