CVE-2015-5515

The Views Bulk Operations VBO module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO...

PT-2015-6967

Name of the Vulnerable Software and Affected Versions Views Bulk Operations VBO module versions 6.x-1.x and 7.x-3.x before 7.x-3.3 Description The issue allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing...

CVE-2015-5515: Undefined Security Weakness

The Views Bulk Operations VBO module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO...

OracleVM 3.3 : net-snmp (OVMSA-2015-0099)

The remote OracleVM system is missing necessary patches to address critical security updates : - Add Oracle ACFS to hrStorage John Haxby orabug 18510373 - Quicker loading of IP-MIB::ipAddrTable 1191393 - Quicker loading of IP-MIB::ipAddressTable 1191393 - Fixed snmptrapd crash when '-OQ' paramete...

Fedora 22 : drupal7-views_bulk_operations-3.3-1.fc22 (2015-11318)

7.x-3.3 See SA-CONTRIB-2015-131 Changes since 7.x-3.2: - Fix security vulnerability, by AdamPS. - Remove an entitylabel workaround that core no longer needs. - Issue 2427381 by axel.rutz: Rules component lacks entity type - Issue 2418751 by anrikun: Archive action fails silently - Issue 2318273 b...

Fedora 21 : drupal7-views_bulk_operations-3.3-1.fc21 (2015-11278)

7.x-3.3 See SA-CONTRIB-2015-131 Changes since 7.x-3.2: - Fix security vulnerability, by AdamPS. - Remove an entitylabel workaround that core no longer needs. - Issue 2427381 by axel.rutz: Rules component lacks entity type - Issue 2418751 by anrikun: Archive action fails silently - Issue 2318273 b...

[SECURITY] Fedora 21 Update: drupal7-views_bulk_operations-3.3-1.fc21

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

[SECURITY] Fedora 22 Update: drupal7-views_bulk_operations-3.3-1.fc22

This module augments Views by allowing bulk operations to be executed on the displayed rows. It does so by showing a checkbox in front of each node, and adding a select box containing operations that can be applied. Drupal Core or Rules actions can be used. This package provides the following...

Drupal Views Bulk Operations Module Access Bypass Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Views Bulk Operations is one of the third-party modules used to change views on nodes. An access bypass vulnerability exists in the Drupal Views Bulk Operations module in version 6.x-1....

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131

The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows. The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled suc...

Shopify: XSS at Bulk editing ProductVariants

Steps to Reproduce: 1.Create a Product with Title and Description as " 2. Now goto https://blahblah.myshopify.com/admin/products/inventory 3. Select the Product created at Step 1 and Click on Edit variants and XSS will be triggered...

Shopify: XSS at Bulk editing products

after following above the steps in 67125 goto Bulk editing products: for me the url was: https://img-src-x-onerror-prompt1-24.myshopify.com/admin/bulk?resourcename=Product&edit=variants.sku%2Cvariants.price%2Cvariants.compareatprice&message=&returnto=%2Fadmin%2Fproducts&ids=1151578433 it is also...

Sunset of Section 215 Means All Eyes on USA FREEDOM Act

The sun may have set at midnight on Section 215 of the PATRIOT Act, putting a temporary halt to the NSA’s bulk collection of phone call metadata, but privacy champions and legal experts point to May 7 as the day the lights dimmed on that facet of the government’s surveillance efforts. On that...

Shopify: Bulk Discount App in myshopify.com exposes http://bulkdiscounts.shopifyapps.com vulnerable to XSS

Installing the Bulk Discount App in .myshopify.com which requires a paid basic plan makes the bulkdiscounts.shopifyapps.com vulnerable to XSS due to non sanitized input in products and collections. POC: 1. Enter a product name or a collection such as " and save it. 2. Install the Shopify...

[SECURITY] Fedora 22 Update: drupal7-ctools-1.7-1.fc22

This suite is primarily a set of APIs and tools to improve the developer experience. It also contains a module called the Page Manager whose job is to manage pages. In particular it manages panel pages, but as it grows it will be able to manage far more than just Panels. For the moment, it includ...

New Coalition Launches Fight Against Patriot Act Section 215

A broad group of civil-rights, technology and political groups from across the spectrum has developed a new initiative to advocate for the repeal of Section 215 of the USA PATRIOT Act, the part that provides the authority for the bulk collection of phone metadata and other information. The new...

Snapchat: Captcha Bypass in Snapchat's Geofilter Submission Process

Hi, Overview: Snapchat provides a form in which users can submit "Geofilters". These are filters which get applied to users snaps when they are in specific geolocations. The form https://www.snapchat.com/geofilters/submit.html allows for the submission of these "Geofilters" as an anonymous user...

Tech Companies, Privacy Advocates Call for NSA Reform

A group of technology companies, non-profits and privacy and human rights organizations have sent a letter to President Barack Obama, the director of national intelligence and a wide range of Congressional leaders, calling for an end to the bulk collection of phone metadata under Section 215 of t...

WordPress Plugin SEO by Yoast Cross-Site Request Forgery Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports setting up personal blog sites on servers with PHP and MySQL.WordPress SEO by Yoast is one of the search engine optimization plugins. A cross-site request forgery vulnerability...

CVE-2015-2292: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/class-bulk-editor-list-table.php in the WordPress SEO by Yoast plugin before 1.5.7, 1.6.x before 1.6.4, and 1.7.x before 1.7.4 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in...